Tommaso Gagliardoni

Cryptography, privacy, quantum security, infosec, retro vibes.

Public Key

npub1k59v80s4e4rcen5fyslp3l7txuxzy3v24v6h2cafwjemdt4rs4yqvy6xp5

NIP-05 Address

Profile Code

nprofile1qqst2zkrhc2u63uve6yjg0scll9nwrpzgk92kdt4vw5hfvak463c2jqpp4mhxue69uhkummn9ekx7mqpzemhxue69uhhyetvv9ujuurjd9kkzmpwdejhgs27zpk

Publishing to

Author Public Key

npub1k59v80s4e4rcen5fyslp3l7txuxzy3v24v6h2cafwjemdt4rs4yqvy6xp5

Show more details

Last Notes

2026-07-23 08:54:19 GMT

And now, after banning vaguely-defined "LLM-generated code", Codeberg bans cryptocurrency projects. Discussion:
https://codeberg.org/Codeberg/org/pulls/1254
The specific ban is for "Content that harms the reputation of Codeberg, such as cryptocurrency related projects":
https://codeberg.org/Codeberg/org/commit/f383b648fd733ab88083dc390b91e77cd7589980
I think the reputation of Codeberg has been now harmed enough. When I originally escaped GitHub, I chose Codeberg exactly for the ethical stance and values. For me, anti-censorship is a non-negotiable ethical value. The folks at Codeberg have the right to run their org as they want. However, having now shown that they consider "censorship" good when it's about things they dislike, this made clear that their values and mine are not compatible (even if I dislike those same things, mind you).
Supporters of this ban say that this "draws a line", that "is not meant to be applied blanket-wide to all projects, only those which are harmful to the community", as if having constantly to worry about the next mood swing of Codeberg voting members were an acceptable Sword of Damocles for any reputable project. What's next? Banning US users? Banning software aligned with "capital-fascist" values? Open-source banking/wallet apps? Quantum computing tools? Robotics?
I'm moving off Codeberg, probably to Radicle. But I feel a bit sad, because Codeberg had the potential, in my opinion, to become the European alternative to GitHub, and they have made clear that they are not ready nor willing to become so. Which is fine: software *is* political, and everyone has the right to express their political stance.
But we still desperately need an alternative to GitHub.
#codeberg #drama #github #radicle #politics #opensource #bigtech #eu #europe #europa #usa #digitalsovereignty #ethics #censorship #crypto #web3 #blockchain #ai #llm #vibecoding

2026-06-04 08:41:45 GMT

Hey #nostr I was thinking: is anyone developing an Android app (and related NIP) for Nostr key management, similar to Amber but, instead of relays, using local/near field connections? Like, NFC, USB/serial, Bluetooth? So it wouldn't require network connection between signing device and Nostr client?

2025-09-04 06:38:21 GMT

@nprofile…7gha I'm interested in your Nostr subkeys NIP proposal https://gist.github.com/melvincarvalho/0eeba92ad49bd7f8907694751ec20cbd I was wondering if there is any update on it?

2025-06-17 12:27:56 GMT

@nostr @nprofile…7gha #nostr is there a way to import a Nostr key as a subkey part of a PGP key?

2025-06-05 20:47:59 GMT

- reply

I did an amazing InterRail trip to France and Spain, with some friends from Italy, back in 2002. It was our first backpacking experience, I remember we stuffed our backpacks with packs of pasta (the proper type, not the "ready to cook" one), jars of tomato, salt, garlic, peperoncino, and olive oil. For 4 weeks of nomadic camping, our diet was mainly that, plus the sporadic tuna can or chorizo to reintegrate proteins. One of those trips you can only survive when you're 19. It was the early times of the Euro, I remember how magic it felt going to a foreign country and buying grocery in cash without having to juggle currencies. Memory unlocked.

2025-05-02 09:25:49 GMT

#Nostr privacy questions:
1) am I correct that events are only signed, not encrypted, and hence relays can see the content that I, user, publish and fetch?
2) Are relay connections always HTTPS-encrypted?
3) If I fetch events through relay A, and relay A requests them to relay B, does relay B know that I (user) requested that content? Or only knows that "somebody behind relay A" did?

2025-04-15 09:20:10 GMT

- reply

Hey @nprofile…qgly I want to say I appreciate a lot your presence on federated/decentralized social media. May you set a good examples for all those EU official entities who still have their main presence on Facebook/Twitter.

2025-04-03 09:31:13 GMT

Tomorrow I'll be at the Swiss Crypto Day in Lugano. Looking forward to this local but important event! #swisscryptoday #swiss #switzerland #cryptography #lugano

2025-04-02 18:00:40 GMT

My view on the mysterious disappearance of cybersecurity academic Xiaofeng Wang:
https://gagliardoni.net/#20250402_xiaofeng_wang
#usa #trump #china #cybersecurity #fbi #xiaofengwang

2025-04-02 06:43:36 GMT

- reply

Bellissimo rant. Purtroppo non credo sia così solo in Italia. Il profilo che citi è quello che si definisce "cryptobro" e, sì, è imbarazzante. Frens, don't be like that!

2025-03-24 13:29:59 GMT

https://infosec.exchange/@tomgag/114217645359273562

2025-03-23 20:53:34 GMT

Attending #ZKProofs7 in #Sofia #Bulgaria right now. Lot of interesting talks AND folks

2025-03-22 15:24:25 GMT

- reply

Amazing! It works! Thanks ^^

2025-03-22 14:49:16 GMT

- reply

I'm trying to follow https://github.com/nostr-protocol/nips/blob/master/05.md in particular at the section "Showing just the domain as an identifier" so I use [email protected] in my profile's NIP-05 field. Basically I would like people to tag me with @tomgag.net rather than [email protected] . Am I doing it wrong?

2025-03-22 12:34:02 GMT

- reply

Amazing, thanks, I missed that! Now the CORS tester greenlights, bit I still cannot see myself as verified in both Coracle and Amethyst, I hope it's just a matter of time for the client to fetch the updated status?

2025-03-22 09:33:49 GMT

@nprofile…mnuc test from #nostr

2025-03-22 09:30:54 GMT

- reply

Seems OK? https://tomgag.net/.well-known/nostr.json

2025-03-22 07:40:22 GMT

Can someone explain me why my #NIP-05 verification doesn't seem to work? I am using a JSON file at my domain tomgag.net but I see a red exclamation mark next to it (on #Amethyst )

2025-03-20 17:17:57 GMT

Let's give this a try. #nostr sounds cool, I like the idea. I don't like too much that apps can bridge profiles from other media and make them look like the real thing. For example, this ( npub1un4zcpgku6z6cgaqd67haeq4mym8u5teeqdw5r4kaa5eye8x8vcs87tqn3
[email protected] ) is a bridge to my (legit) #mastodon account ( @tomgag @infosec.exchange ). A bit confusing if you ask me, because I do not control the private key for that bridge, you have to trust @mostr.pub to not impersonate accounts.

2025-03-20 16:25:36 GMT

Hello world! #introductions