stf

https://pitchfork.ist, libopaque, https://sphinx.ctrlc.hu, pysodium, https://klutshnik.info, https://sphinx.pm

#searchable #cypherpunk

Public Key

npub1hzrmll8k8p3hv0r3yczfgjarfnmtge62h2we44vxlk3c805lqlyqe4fe37

NIP-05 Address

[email protected]

Profile Code

nprofile1qqst3pallnmrscmk83cjvpy5fw35ea45va9t48v66kr0mgurh60s0jqpz4mhxue69uhhyetvv9ujumt0wd68ytnsw43qhcn0uw

Publishing to

relay.mostr.pub

Author Public Key

npub1hzrmll8k8p3hv0r3yczfgjarfnmtge62h2we44vxlk3c805lqlyqe4fe37

Show more details

Last Notes

2026-11-04 20:20:42 GMT

hearing chatter about another very bad crit vuln on linux incoming. "it's bad, very bad" - brace yourself for the fantastic season finale of cyberawareness month.

2026-11-04 13:46:44 GMT

quickly registers apt2shell.com

2026-11-04 13:43:15 GMT

burn pictures on cd roms: https://github.com/JiaFeiMiao-K-Cat/DiscImageStudio

2026-11-03 23:00:01 GMT

i was thinking. these ledger wallet implants can easily be detected by weight measurement. we just need to know the official uncompromised device weight, and then it should be easy-peasy to "look" at a device and say if this kind of implant is present or not. i suppose we can even identify the implants by how much weight they add.
#supplychain #security #wallets

2026-11-02 21:29:19 GMT

huh, this #romu looks like a perfect vehicle for the zephyr-based variant of #klutshnik: https://www.crowdsupply.com/bitmerse/romu - although a bit pricey, it is definitely small enough to hide(lose?) in plain sight.

2026-11-01 12:20:04 GMT

the good kind of whataboutism.

2026-10-23 15:32:07 GMT

zomg on my primary device:
locate cacert.pem | xargs grep -l 'emSign.*G3' | wc -l
returns 92, mostly in python virtualenvs. what a cancer.

2026-10-21 20:58:06 GMT

i feel like VLA in structs is actually a good thing in very specific conditions. I have to construct a blob that contains - among others - multiple length-prefixed string components, why cannot i declare a const fn local struct variable that is immediately initialized? instead i have to calculate the final size of a buffer myself, and then do ptr acrobatics to memcpy() everything in place, or ugly macros. the former is easy to understand and audit, the latter are a nightmare in comparison.
#c

2026-10-21 19:54:41 GMT

ok, what's next? gitlab's next. also high value #RCE: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/

2026-10-21 19:05:35 GMT

AI crawlers blocking the production and delivery of patched versions of php.

2026-10-21 12:42:01 GMT

this, so much this:

2026-10-21 12:40:46 GMT

- reply

@nprofile…9mf3 i know this, this is base64

2026-10-20 21:10:27 GMT

zomg, this is bad:
> pip always loads the CA certificates from its vendored certifi in addition to the system trust store, and there is no supported way to disable this. REQUESTS_CA_BUNDLE / --cert only add CAs; truststore is used “in addition to certifi” by design. As a result, any pip < 26.2.2 will keep trusting the compromised intermediate CAs regardless of the system trust store, so distrusting them at the OS level is not enough.
why vendor and not use the system cert store? seriously???

2026-10-17 22:16:48 GMT

announcing a beginner workshop for drunk chainsaw juggling. BYOB (bandages).

2026-10-17 22:13:34 GMT

fixed a bug in pysodium (and made a new release). the submitter said this:
> And specially thanks to the author for trying to maintain the Python package compatible with ALL versions of libsodium, it is really a notable effort that other crypto libraries do not provide.
unsure if this is an LLM or proper biologically sourced compliment, but it is appreciated.

2026-10-15 01:54:37 GMT

ivanti has some itw exploited 0day https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/

2026-10-12 20:15:44 GMT

https://github.com/h0m3us3r/w1700k-sdr
Turns a Gemtek W1700K Wi-Fi 7 router into a wideband software-defined receiver. The router's MediaTek MT7996 radio captures raw 14-bit IQ at up to 320 Msps, its Airoha AN7581 SoC streams it over 10 GbE, and a Linux host shows it as a live spectrum and waterfall in the browser, with the receiver's controls next to it.
#sdr #radio #hack

2026-10-12 11:34:21 GMT

i just had the horror idea that the IETF RFCs will now be completely meatproxied. 🤮

2026-10-11 12:48:01 GMT

@nprofile…kjet

2026-10-10 15:25:22 GMT

SecretStack is a Zig library that runs code handling secrets on a separate stack. It wipes the whole stack and the CPU's scratch registers when your function returns.
https://github.com/jedisct1/zig-secretstack
by @nprofile…q6ze

2026-10-03 19:10:23 GMT

pre-ordered.

2026-09-24 11:49:45 GMT

so, uhm, #radicle i'm a huge :fan: but this is embarrassing: https://radicle.dev/2026/09/23/disclosure-of-vulnerability-in-network-protocol.html
is there any chance you get a good security / general code audit please? oh, and a full spec of your protocols would also be extremely useful.

2026-09-20 12:11:36 GMT

reading a baking recipe, and am confused at the temperatures, then it hits me - it's cultural, i wonder why not measure temperature in football fields or library of congress?

2026-09-09 13:25:20 GMT

not only is this a very good initiative (although cash-based, human operated vending would be even more awesome) this is also about the 1st time i see the @nprofile…fu0r engage multiple times in a "thread".
nice to have good news, and positive interactions, need moar!

2026-09-05 21:04:20 GMT

\o/ #klutshnik server now also builds with #zig v0.16 \o/
https://rad.ctrlc.hu/nodes/rad.ctrlc.hu/rad:zogkw4qiTrH7rKVa89BrKo8z5miA/commits/699e50ac9301b94b4854438f9021ef73160709f9
klutshnik - unlike the common tools like pgp and age - is an online threshold data-at-rest crypto system that provides very cheap and efficient key-updates and thus forward secrecy and post-compromise security.

2026-08-30 22:27:36 GMT

phew it* finally compiles! with #zig v0.16 (i know i'm a bit late) the #iocalypse was quite some effort to avert. now let's try to port #klutshnik** too
[*] zphinx server: https://sphinx.pm
[**] https://klutshnik.info

2026-08-22 13:44:08 GMT

- reply

@nprofile…t2dp i don't see any abyssinian cat emoji on this list. :/

2026-08-21 17:32:39 GMT

duck that ship

2026-08-20 11:39:17 GMT

acab time + 25(!) = leet time!
hail eris!

2026-08-19 19:39:06 GMT

- reply

@nprofile…tk8a @nprofile…lwur sorry for barging in here, but what is the definition in this case for "cybersecurity company" and for "tooling"? depending on the answer radicallyopensecurity might be contrapoint, i work for them and can help finding out if we fit or not that hat...

2026-08-18 20:02:06 GMT

- reply

@nprofile…4nyz i hope you can deduct the answer from this link https://web.archive.org/web/20161120080823/https://openpgp-conf.org/program.html#stefan
(have to use the archive.org copy, the original is unsafe and inoperational?)
this blogpost is an update to that talk: https://www.ctrlc.hu/~stef/blog/posts/on_pgp.html

2026-08-15 15:36:47 GMT

suppose i have one of these small ESP32 thingies which drives a peripherial - all neatly on a board. Is there some generic component - that comes with a usb and battery connector - that i can solder onto the power pins of the board so that it becomes portable and rechargable and preferably i can choose what size of LiPo battery i attach?
yes, i'm lazy, don't want to design&build a specific solution.
#electronics #battery #component

2026-08-15 10:43:42 GMT

- reply

@nprofile…e5jr i agree 99% with you. however in my https://klutshnik.info tool, there is a homomorphic operation, that allows to update a key-encryption-key without having to de and then reencrypt the data-encryption-key, in a way, that this update can be done on an untrusted server. all other tools like pgp/age etc all need to decrypt the key and thus exposing it before reencrypting it with the new key. klutschnik provides PFS/PCS on untrusted servers, unlike the "industry-best-practice"...

2026-08-13 10:35:58 GMT

- reply

@nprofile…5psv i think it is time to stop calling them settlers.

2026-08-09 20:34:26 GMT

- reply

@nprofile…f30g sorry, but Crowdstrike crashed a conservatively estimated 8.5 million Windows on July 19, 2024.
#neverforget #zerocoolday

2026-08-06 10:26:47 GMT

new german insults dropped: klimaanlagenbenutzer and mitderbahnpünktlichfahrer #cope #db

2026-08-04 22:26:49 GMT

very nice analysis of the limits of #meshtastic for #disaster #communication why it is probably unsuitable for disaster communication, but also where and how it could make limited sense.
translate it with your favorite translation tool: https://qrp.hu/a-meshtastic-halozatok-veszhelyzeti-kommunikacios-alkalmassaganak-kritikai-vizsgalata/
#radio #lora

2026-08-04 10:59:23 GMT

is there already some statistical pattern recognizer (aka AI before the times of LLMs) that automatically guesses modulation of radio signals? working with #rtlsdr or with #gnuradio?
#sdr #radio

2026-08-02 09:57:27 GMT

it's strange how my conviction regarding the superiority of bikes as a means of transportation instantly evaporates as i vacate the flat netherlands for some other location with much higher altitude diversity, only to be replaced with a conviction of the superiority of e-bikes for transportation. and even this conviction is quickly disolved in rain or snow...

2026-07-31 17:35:00 GMT

- reply

@nprofile…20he the thing is, one end is a CPE the other end some 5GHz Point-to-Point network channel, the latter one needs PoE, and the distance from the CPE to the top of the hill with the "dish" is 150m...

2026-07-31 13:53:45 GMT

- reply

@nprofile…rnjh sure, depending on waiting means days, weeks, or months?

2026-07-31 13:50:09 GMT

- reply

@nprofile…rnjh intriguing, you have links for these fiber/copper converters and the outdoor fiber?

2026-07-31 13:12:37 GMT

anyone experienced with #outdoor high-speed #ethernet (~150m) cabling and possibly also somewhere half-way injecting solar-based PoE? is this a thing?

2026-07-31 12:47:42 GMT

wooohooo, new toy incoming:
> Your Crowd Supply order (Dabao Evaluation Board for Baochip-1x) has shipped!

2026-07-30 19:48:06 GMT

another torment nexus predicted by SF, Vernor Vinge: Rainbows End

2026-07-26 11:50:51 GMT

- reply

@nprofile…gaxe https://blog.cryptographyengineering.com/2024/08/25/telegram-is-not-really-an-encrypted-messaging-app/

2026-07-22 21:16:52 GMT

if only #mastodon would support *any* kind of shitty search for posts scrolling by... but even when i know to query "from:@nprofile…qgf4 <term>" i get 0 posts, but 3 completely irrelevant profiles, for any term, even terms that i see in my feed which are in the toots by this person... it's not like i want to search for new content, i want to find back a toot i saw before. and yes, i know about @nprofile…uz0y supporting mastodon, but @nprofile…uz0y does not support my chosen alternative browser. so i'm fubar

2026-07-20 20:31:28 GMT

i have the previous revC and it is the best investment in a long time, so much comfort, so much versatility, so much speed, it's an amazing gadget, i'll definitely get a revD as well, you should too...

2026-07-20 20:21:05 GMT

- reply

@nprofile…lsf6 @nprofile…qcxt 's @nprofile…uz0y supports mastodon, give it a try...

2026-07-19 17:49:13 GMT

- reply

@nprofile…n4cx i dunno, the client is king as they say, so it really doesn't matter if there is a human (in the loop) or just an llm, what i need is coping strategies with this situation. where the educational aspect of my work is kinda lost, with humans, i'm always happy to show them how to avoid, how to use tools in the future, but with an llm, there is no such level-upping the client.

2026-07-19 17:47:12 GMT

- reply

@nprofile…46jr nah, i think there is a human in the loop copy/pasting between the chat and the llm.

2026-07-19 14:50:25 GMT

can anyone advise good methods to cope with the nagging feeling that the customer i'm chatting with is really just the output of an #llm. i'm most triggered by "you are absolutely correct" and my "excellent observations" and similar sycophantic compliments. i never thought i'd miss the denial and passive anger of traditional vendor responses...
#pentester

2026-07-16 14:10:58 GMT

- reply

@nprofile…5g5l i do this, because i noticed that every time i use the self-scan cassa i'm flagged for a check by a clerk, which messes up the order of things in my bag (so squishy stuff doesn't get squished) and in total takes more time than using the traditional human-manned cassa. so there is absolutely no benefit for me using the self-scan cassa.

2026-07-12 22:50:05 GMT

- reply

@nprofile…tk8a where is it, in gelderland somewhere?

2026-07-10 13:01:54 GMT

happy customer endorsement. a few months ago i bought an air quality monitor from https://nettigo.pl (better wifi reception, resistant to humidity changes) but it stopped working a few days ago, i mailed Witold - and he responded immediately at 21:00 or so in the evening - past office hours - within a few mails back & forth he helped me diagnose the problem & even provides a beta fw version in which the problem should not be happening anymore. if you need to buy some stuff, think nettigo

2026-07-09 16:46:16 GMT

- reply

@nprofile…y6rq there's gonna be a 2nd/nth reading just like with #chatcontrol - the voting will continue until morale improves^W^Wthe dystopic choice wins.

2026-07-09 14:31:05 GMT

- reply

@nprofile…0uat did it really pass? or has it only been referred to 2nd reading?

2026-07-09 14:29:50 GMT

- reply

@nprofile…v82z i don't expect 100% conversion rate, far from it - i've seen the inability of people switching after snowden... also network-effects, platform lockin and marketing are counter forces, but this is something that can nudge a few percent in a less centralized/controlled direction, and every time a few percent switch, that is good.

2026-07-09 13:26:15 GMT

i'm wondering about this #chatcontrol thing, even if it has been adopted, only the #cyberproletariat loses, the ones who are already fucked from so many directions, the #cyberbourgeoisie has their own signal-cli clients, molly, xmpp servers, etc. the criminals have their own non-oligarch-controlled hubs. so maybe this is not so bad, if it pushes also the proletariat to use use less centralized (and thus controllable) services... why am i wrong?

2026-07-09 13:22:43 GMT

- reply

@nprofile…mvhg if i get this right, then this is not adoption of chatcontrol, on of letting it pass for a 2nd reading. so the fight is still on.

2026-07-09 13:21:53 GMT

- reply

@nprofile…mvhg so do i get this right? chatcontrol 1.0 has not been adopted, only allowed to pass for a 2nd reading?

2026-07-02 14:45:18 GMT

much controversy in the #IETF, while #NSA is using their budget to stuff the ballot, i'm unsure if @nprofile…ph0g and @nprofile…uvmw are campaigning publicly for adoption or against @nprofile…y6rq, but one is clear, @nprofile…c6ly is clearly the hero of this flame. random post from the thread - which is super drama and high popcorn value: https://mailarchive.ietf.org/arch/msg/tls/L87JNYxG_7YvyYw0VdwRD0Ix0Kg/
#pq

2026-07-01 14:08:59 GMT

nice comparison graph of ciphertext/pubkey sizes of post-quantum kems: https://pqshield.github.io/nist-sigs-zoo/kems/
it does not say anything about their projected classical security though.

2026-07-01 12:42:01 GMT

sweet holy mother of surprise! surely not the same Aura Salla who was chief-lobbyist for facebook before being elected to the European Parliament?

2026-07-01 12:28:53 GMT

- reply

@nprofile…y6rq and despite it being "weak enough to break", when DES was deployed, they replaced DES with backdoored much weaker algorithms in both military (https://www.cryptomuseum.com/crypto/philips/ua8295/sbt.htm) and in commercial products (https://www.cryptomuseum.com/crypto/philips/px1000/nsa.htm). - i have reverse-engineered both algorithms, find out more on https://rad.ctrlc.hu/nodes/rad.ctrlc.hu/rad:z46AkAERuXAzqZcDRKvE7byRbkga1 and https://github.com/stef/px1000cr

2026-06-29 11:03:07 GMT

- reply

@nprofile…lsf6 still sounds like org-mode to me. labels, definitely a well supported thing beyond hiliting. am i replyguying now? kill me...

2026-06-28 20:27:57 GMT

- reply

@nprofile…lsf6 the org prefix is a hint what the original purpose was, and since it is about organizing, TODO is automatically highlighted, you can even have small [] checkboxes which you can check/uncheck, and top of the section will give you a nice percentage of how many subtasks are already completed. hiliting TODO in md is a very poor reimplementation of this. org-mode is amazing 4 organizing thoughts & todos. also very nice for latex beamer presentations & blog posts, but that is another story.

2026-06-28 11:31:30 GMT

- reply

@nprofile…lsf6 “Those who do not understand Unix^Worg-mode are condemned to reinvent it, poorly.”

2026-06-26 10:35:57 GMT

- reply

@nprofile…y4p7 ich schlage to vorratsministerspeicherung vor, hinter gittern, oder gleich alle loschen...

2026-06-24 22:18:58 GMT

- reply

@nprofile…z3lm sounds like agent curveball to me serving a "casus belli" https://en.wikipedia.org/wiki/Curveball_(informant)
#conspiracy #pq #disinfo

2026-06-23 13:03:30 GMT

interesting thread about @PolizeiBerlin cops abusing access to internal databases in the last year. good argument against such dbs...

2026-06-20 19:11:31 GMT

- reply

@nprofile…zszz sounds good to me, remember which it was?

2026-06-20 18:43:06 GMT

does anyone have experience with these free sms receiver sites? the few i found are rejected. or any recommendation for very cheap european throw-away esims?
#privacy #registration #account

2026-06-20 12:04:37 GMT

in 2017 the government collapsed due to similar fraud, a few years later this also denied one of the involved to become EU commissioner. and the Le Pens were also tried in court over similar theft.

2026-06-16 16:25:56 GMT

- reply

@nprofile…phm5 any insight into why zlib-rs is faster?

2026-06-15 13:40:29 GMT

- reply

@nprofile…tk8a i remember talking to the IT dept of the VPRO (dutch national tv chan, 1 of many) - 3-4 people in total, completely addicted and vendor-locked into US services, i remember their SSO was super expensive, for a 10th they could've commissioned their own free sw variant and paying for maintenance would've been a fraction of that further on. the opposition to this was massive, despite the huge costs savings - very un-dutch...

2026-06-12 11:20:45 GMT

- reply

@nprofile…fqfm you must be (raises hand flat) this old to fully understand this joke...

2026-06-09 16:57:18 GMT

- reply

@nprofile…tk8a @nprofile…02n7 let's not forget that the UK is the founding partner of the FVEY and i am less than enthusiastic about a private equity firm challenging any request for cooperation in the interest of "national security".

2026-06-09 16:44:43 GMT

- reply

@nprofile…02n7 are you trying to out-dutch the dutch? 🤣 the problem is not the cloud act - the problem is that this (as in any government service or any national infrastructure) is not owned by the dutch state.
. <- the dutch
.
.
.
lighyears, pah, galaxies....
.
.
.
-------> sovereignty
(last time i checked, the UK has a law that puts you in jail if you don't surrender your passwords, so maybe no cloud act, but still fucked up justice system)

2026-06-09 16:09:21 GMT

- reply

@nprofile…tk8a good article, but
"oh fuck me" this quote:
"Solvinity, which is based in Amsterdam, has a foreign owner in Vitruvian Partners, a British private equity firm."
(solvinity operates the dutch government citizen identity service)
really a british Private Equity firm is better? Who the hell approved that sale? this is all sooooo dutch.

2026-06-08 22:31:55 GMT

insightful piece how the EP protected our rights, while the council refused to negotiate, and the commission intentionally created pressure and then even committed maladministration, again.
https://edri.org/our-work/did-the-eu-parliament-really-vote-not-to-protect-children-online/
#chatcontrol #europe #commission #parliament #council

2026-06-08 13:31:46 GMT

why are there *mountain* bikes in the netherlands?

2026-06-06 11:06:05 GMT

- reply

@nprofile…mex9 i don't want to spoil too much, but John Scalzi's Starter Villain is very very relevant and one of the most funny books i read in years....

2026-06-05 23:41:46 GMT

- reply

@nprofile…hdfz ah, you lost me at bar... :)

2026-06-05 20:06:12 GMT

- reply

@nprofile…hdfz watching or doing? i can tell you doing is like a drug, all those delicious dopamines and endorphines...

2026-05-28 19:24:20 GMT

#poetry #netherlands has no edible #bread i got a present #baguette from #france and bought me some french #cheese to celebrate the occasion of being able to eat proper bread. after cheesegasming i was bragging to a french friend (and cheese maximalist) of mine thusly:
https://assets.chaos.social/media_attachments/files/116/653/820/010/573/969/original/ca154114c2c09b55.png

2026-05-28 19:19:59 GMT

spouse insists that some of my brainfarts are poetry, and i should publish them. circumventing the 500 char limit with imgs/alt-text.
context: spouse has a bunch of chainsaws.
#poetry #netherlands #biking
https://assets.chaos.social/media_attachments/files/116/653/811/731/585/144/original/04cff3dfbca29406.png

2026-05-28 15:21:53 GMT

- reply

@nprofile…9zyf you mean outsourced to detsche telekomm, SAP or siemens :)

2026-05-28 15:21:11 GMT

- reply

@nprofile…hdfz it's either a sailing boat (ykiyk) or a goatse (ditto)

2026-05-28 15:09:50 GMT

- reply

@nprofile…xyvp looks like totally normal "gezellig" dutch furniture. but as the dutch are, they made a buck out of their calvinist aversion to anything pleasurable and exported this as weaponized homeless torture devices.

2026-05-28 15:03:35 GMT

- reply

@nprofile…9zyf deutsche bahn is state captured by the interests of a waning german car industry, DB has some old german conservative politician as the head of DB afaik serving the interests of his sponsors.

2026-05-26 11:09:19 GMT

PRESS RELEASE
Today, our engineering team announced a streamlined editorial workflow powered by the Unix tool sed, enabling instant, consistent replacement of the symbol & with the word “and” across all communications. This improvement strengthens clarity, supports accessibility, and ensures brand‑wide linguistic consistency. By integrating sed into our publishing pipeline, we reaffirm our commitment to precision, efficiency, and high‑quality content delivery.

2026-05-26 11:00:28 GMT

private company in charge of the dutch government-portal login was supposed to be bought by an american company. for months everyone was telling the nl government to block this, but of course the dutch ruling coalition is made of soft-bellied pro-business transatlantic cocksuckers, it took a while, but now they finally made the right decision.

2026-05-22 18:07:42 GMT

the good thing about this, maybe we can recover the deleted messages between pfizer and von der leyen...

2026-05-14 11:03:59 GMT

wtf they rewrote bun in rust using an llm: https://github.com/oven-sh/bun/pull/30412
only one month after we saw the claude sacrifice to the spaghetti monster from the leaked code of anthropic.
of course the testuite passes with sleep(1) fixes: https://github.com/oven-sh/bun/pull/30412/commits/68a34bf8ed550ed69f4a0c18cff5ca9bd41d36ef
we need to open the strait of hormuz for strategic popcorn reserves...

2026-05-12 12:37:23 GMT

#eurocrypt just happened, which reminds me of the eurocrypt 35 years ago held in budapest, which an #NSA cryptologist was attending and giving a scorching #report in the internal cryptolog newsletter of the nsa: https://scottaaronson.blog/?p=2059
would be interesting to see the latest cryptolog report on this latest edition...

2026-05-09 10:46:46 GMT

i am running my own public node since year or so, and am quite happy, i hope this is the future, but am afraid it's too far from the expectations established by the git(lab|hub|ea) model - there is a bunch of things that are not intuitive coming from that angle.

2026-05-07 20:15:47 GMT

- reply

here's a variant? called dirtyfrag: https://github.com/V4bel/dirtyfrag / https://dirtyfrag.io or is this the classname?

2026-05-07 19:56:42 GMT

copyfail is a bugclass, instance 2: https://github.com/0xdeadbeefnetwork/Copy_Fail2-Electric_Boogaloo

2026-05-06 20:05:23 GMT

- reply

@nprofile…hf80 nah, i use mutt as a mail client, for 26 years now