Loup-Vaillant wrote this on Lobste.rs in a dumb rant about my Matrix disclosure:
Uncategorized
17
Posts
12
Posters
0
Views
-
Loup-Vaillant wrote this on Lobste.rs in a dumb rant about my Matrix disclosure:
Personally I would actively avoid the check,
Hmm. What a weird thing to say.
Loup-Vaillant wrote a cryptography library called Monocypher, which famously had an EdDSA vulnerability mostly caused by their insistence on rolling their own custom EdDSA variant to avoid SHA512.
"I wonder how Monocypher holds up in 2026?"
Who said that? Well, anyway:
-
Loup-Vaillant wrote this on Lobste.rs in a dumb rant about my Matrix disclosure:
Personally I would actively avoid the check,
Hmm. What a weird thing to say.
Loup-Vaillant wrote a cryptography library called Monocypher, which famously had an EdDSA vulnerability mostly caused by their insistence on rolling their own custom EdDSA variant to avoid SHA512.
"I wonder how Monocypher holds up in 2026?"
Who said that? Well, anyway:
@soatok Feuding crypto-experts hate-reviewing each other's code is exactly the kind of vibe we need. Talk about adversarial testing! 😎
-
Loup-Vaillant wrote this on Lobste.rs in a dumb rant about my Matrix disclosure:
Personally I would actively avoid the check,
Hmm. What a weird thing to say.
Loup-Vaillant wrote a cryptography library called Monocypher, which famously had an EdDSA vulnerability mostly caused by their insistence on rolling their own custom EdDSA variant to avoid SHA512.
"I wonder how Monocypher holds up in 2026?"
Who said that? Well, anyway:
@soatok because who checks for buffer lengths in c anyways it just wastes cycles
wat
also pretty sure "user error" is exactly how exploits are born
-
Loup-Vaillant wrote this on Lobste.rs in a dumb rant about my Matrix disclosure:
Personally I would actively avoid the check,
Hmm. What a weird thing to say.
Loup-Vaillant wrote a cryptography library called Monocypher, which famously had an EdDSA vulnerability mostly caused by their insistence on rolling their own custom EdDSA variant to avoid SHA512.
"I wonder how Monocypher holds up in 2026?"
Who said that? Well, anyway:
@soatok
OMG. These two paragraphs are one after the other in their documentation (https://monocypher.org/manual/#CAVEATS ). Do they not see how tightly linked they are??> CAVEATS
> Monocypher does not perform any input validation. Any deviation from the specified input and output length ranges results in undefined behaviour. Make sure your inputs are correct.
>
> SECURITY CONSIDERATIONS
> Using cryptography securely is difficult. Flaws that never manifest under normal use might be exploited by a clever adversary -
Loup-Vaillant wrote this on Lobste.rs in a dumb rant about my Matrix disclosure:
Personally I would actively avoid the check,
Hmm. What a weird thing to say.
Loup-Vaillant wrote a cryptography library called Monocypher, which famously had an EdDSA vulnerability mostly caused by their insistence on rolling their own custom EdDSA variant to avoid SHA512.
"I wonder how Monocypher holds up in 2026?"
Who said that? Well, anyway:
@soatok making input validation (with many preconditions and requiring specific knowledge) a user's responsibility sounds like a recipe for disaster
-
@soatok making input validation (with many preconditions and requiring specific knowledge) a user's responsibility sounds like a recipe for disaster
@inex @soatok "Look, I only gave the user a foot-gun. Most users know how to not use the foot-gun. I mean yes, it is a gun; and yes, it is pointed automatically at their foot; and yes, it is loaded and has a hair trigger; but users should know better. I mean they are programmers, for heaven's sake, they should know about trigger discipline."
-
@inex @soatok "Look, I only gave the user a foot-gun. Most users know how to not use the foot-gun. I mean yes, it is a gun; and yes, it is pointed automatically at their foot; and yes, it is loaded and has a hair trigger; but users should know better. I mean they are programmers, for heaven's sake, they should know about trigger discipline."
-
Loup-Vaillant wrote this on Lobste.rs in a dumb rant about my Matrix disclosure:
Personally I would actively avoid the check,
Hmm. What a weird thing to say.
Loup-Vaillant wrote a cryptography library called Monocypher, which famously had an EdDSA vulnerability mostly caused by their insistence on rolling their own custom EdDSA variant to avoid SHA512.
"I wonder how Monocypher holds up in 2026?"
Who said that? Well, anyway:
-
@rusty__shackleford @soatok Trying to determine if this is bad snark on their part or the output of an AI agent
-
@rusty__shackleford @soatok Trying to determine if this is bad snark on their part or the output of an AI agent
@cwebber @rusty__shackleford The "spell out the acronyms used in the filenames" part does gesture suggestively towards "AI"
The heel-turn on me allegedly not contacting them without an "You're absolutely right!" tells me that, even if it is AI, they at least edited the sycophancy out of it.
-
Loup-Vaillant wrote this on Lobste.rs in a dumb rant about my Matrix disclosure:
Personally I would actively avoid the check,
Hmm. What a weird thing to say.
Loup-Vaillant wrote a cryptography library called Monocypher, which famously had an EdDSA vulnerability mostly caused by their insistence on rolling their own custom EdDSA variant to avoid SHA512.
"I wonder how Monocypher holds up in 2026?"
Who said that? Well, anyway:
@soatok Wait, so the entire input validation scheme is "don't call it wrong?"
That's... well, that's a choice you can make, I guess.
-
@cwebber @rusty__shackleford The "spell out the acronyms used in the filenames" part does gesture suggestively towards "AI"
The heel-turn on me allegedly not contacting them without an "You're absolutely right!" tells me that, even if it is AI, they at least edited the sycophancy out of it.
@soatok @rusty__shackleford you're absolutely right
-
@soatok Wait, so the entire input validation scheme is "don't call it wrong?"
That's... well, that's a choice you can make, I guess.
@wordshaper Our Threat Model is "You must only accept secure inputs if you want secure outputs".
-
@wordshaper Our Threat Model is "You must only accept secure inputs if you want secure outputs".
@soatok good thing this code doesn’t have to operate in an adversarial environment. Something unfortunate could happen.
-
-
undefined oblomov@sociale.network shared this topic
-
@rusty__shackleford @soatok Trying to determine if this is bad snark on their part or the output of an AI agent
@cwebber @rusty__shackleford @soatok I think the "the output length limit is a precondition" definitely stinks of AI, confusing pre and post like that. Either that or somebody is incredibly incompetent.
Resulting, now, in a situation where either someone has to admit how dumb they are or admit they let AI write this, which will result in a double down of angry denial, most likely.
-
@cwebber @rusty__shackleford @soatok I think the "the output length limit is a precondition" definitely stinks of AI, confusing pre and post like that. Either that or somebody is incredibly incompetent.
Resulting, now, in a situation where either someone has to admit how dumb they are or admit they let AI write this, which will result in a double down of angry denial, most likely.
@tekhedd @rusty__shackleford @soatok I did end up thinking about this Nancy comic after I sent this this morning
Gli ultimi otto messaggi ricevuti dalla Federazione
-
@kenobit Secondo me camminata svelta, poi non so esattamente dove abiti e se ci sono parchi o argini, perché farlo in mezzo al traffico è deprimente.
Io cerco 5 volte a settimana di camminare/correre, e di quelle 5, 2 o 3 vado in palestra, però per rimetterti in movimento direi camminare, da 30 a 60 minuti di passo non dico da bersagliere ma quasi.
Ho visto che ti hanno consigliato la camminata nordica (coi bastoncini) che è ottima per muovere anche le braccia (che altrimenti non alleni)
-
@rk When the time comes to prosecute the people who've done this to our country, Talarico isn't going to have the stomach for it. There have to be consequences for criminal acts by ICE, Trump, Hegseth, Bovino, etc. Talarico strikes me as the kind of Democrat who'll "kitchen table issues" us right into a dictatorship. We've got plenty of those Democrats.
I hope I'm wrong about Talarico, though. Because crypto is so vile that I'm not confident we can count on Crockett, either.
-
( Giusto per chiarire ... )
Luca Bizzarri - Non hanno un amico - Ep.819 - "Crosetto senza X (per il suo bene) "
-
Honestly, IMHO, I want someone like Talarico: I want the Christofascists to talk about how he isn’t a real Christian and then he comes back with kindness — like he ostensibly should. For most people, they’ll be too far gone to see it, but it makes shake a few loose from the thrall of religious nationalism.
-
I've been agonizing over the Senate primary. Jasmine Crockett is the rep for my district. I like her. However...she's very friendly with the cryptocurrency industry. Like, she's their inside man in Congress. That's terrifying, because crypto is how corruption happens now. If you want to bribe Trump, you have many options, but one of the most popular is crypto.
Talarico seems too polite for these times. We need a brawler, but I just can't stomach a cryptoshill.
-
@shinmera well damn
-
-
L'Europa è pronta ad abbandonare la tecnologia statunitense in favore di alternative private
Secondo un sondaggio di @protonprivacy condotto su 3.000 persone nel Regno Unito, in Germania e in Francia, la stragrande maggioranza dei consumatori dei tre paesi, ritiene che i propri paesi siano diventati dipendenti dalle aziende tecnologiche statunitensi e più di 8 su 10 sono preoccupati per questa dipendenza.
