Piero Bosio Social Web Site Personale

starts writing on the chalkboard, Bart Simpson style"I will NOT get nerdsniped into another cryptography side-project."

@soatok"why are compilers, man?"hardware fucking weird. assembly very fucking weird, and the only people who want to think about it are the types of fetishists who design compilers so the rest of us don't have to.

@soatok You know, it's kinda interesting that Matrix have not once but twice had the kind of security hole that lets outsides decrypt conversations without being detected. And that their reaction to this is to spindoctor it.It strikes me as the sort of behaviour of a company that has received a court order to open a security hole and a gag order to not talk about it. Especially since they're in the UK which is not exactly known to be crypto friendly.I have to wonder if the versions they sell to governments have the same flaw or not.

@soatok @RueNahcMohr if you enjoy black magic compiler optimizations, I can very much recommend Advent of Compiler Optimisations 2025 by @mattgodbolt:https://www.youtube.com/playlist?list=PL2HVqYf7If8cY4wLk7JUQ2f0JXY_xMQm2

I've never met a bigger group of dumbfucks than Matrix defendersLike holy shit, how are they all so dense

A web developer and a speedrunner have a very different understanding of the term iframe

RE: https://furry.engineer/@soatok/116088925054375056I'm going to be very clear about something:If you tell me that something I reported has "no security impact", I publish it as soon as possible.If you're wrong in your assessment of the actual security impact, that's not my problem.If you're citing an argument about the wrong level of abstraction, I will tell you you're wrong (and why) while I'm publishing.Do you know a neat trick for avoiding this outcome?It's called the Socratic method in fancy circles, but it's basically: Ask clarifying questions.

https://soatok.blog/2026/02/17/cryptographic-issues-in-matrixs-rust-library-vodozemac/#Matrix #infosec #vulnerabiltiy #cryptography #privacy

The crucial thing Arathorn hasn't figured out is he's his own worst enemy when it comes to public relations.Several folks have told me they stopped trusting Matrix. But not because of my write-up. They stopped trusting Matrix because of how Matrix responded to my write-up.They couldn't just said something banal like, "Thanks for contributing to the security of Matrix," and done less damage to their own reputation.

@0x4d6165 That said, secure encryption needs to be lower-friction for most people to use.It needs to be secure even if the end user isn't thinking about security.This is why I've spent years on Key Transparency, where most app developers were perfectly content with "demand users manually verify key fingerprints" instead.

@soatokSince OS repositories rely on gpg for validating package signatures I took the liberty to forward the talk to my support contact at SUSE. He called me half an hour later stating that he's half through the talk and had already forwarded it to their internal security maillist because it's like a bad car accident you know you shouldn't stare at but you just can't stop watching... and I'm pretty sure Red Hat is watching, too.

On this day, all signatures should use the XMSS (hash-based signature system)#XMSS #Xmas

Tell me about something cool you're working on in 2026.

This "UK watchdog" can eat shit.https://www.techradar.com/vpn/vpn-privacy-security/creating-apps-like-signal-or-whatsapp-could-be-hostile-activity-claims-uk-watchdog

@soatok I want them to federate, though.

Yo, check this out.https://blog.trailofbits.com/2025/12/02/introducing-constant-time-support-for-llvm-to-protect-cryptographic-code/

Moving Beyond the NPM elliptic PackageIf you're in a hurry, head on over to soatok/elliptic-to-noble and follow the instructions in the README in order to remove the elliptic package from your project and all dependencies in node_modules. Art: CMYKat Why replace the elliptic package? Yesterday, the Trail of Bits blog published a post about finding cryptographic bugs in the elliptic library (a Javascript package on NPM) by using the Wycheproof.http://soatok.blog/2025/11/19/moving-beyond-the-npm-elliptic-package/#npm #crypto #cryptography #elliptic #security #infosec #cve #mitigation #appsec #javascript #js #npm #npmsecurity #npmpackages

2015: "Not using AWS or CloudFlare is an availability risk, because DDoS"2025: "Using AWS or CloudFlare is an availability risk, because surprise outages"

It was DNSOf course it was DNSFuck Andy Jassy(A new haiku to consider)

@soatok Sent this to my friend, and he decided to try it out. A couple of minutes later, he was banned by OpenAI for ERP