Filippo Valsorda

@FiloSottile elsewhere / Cryptogopher / Go crypto maintainer / Professional Open Source maintainer / RC F'13, F2'17 

https://mkcert.dev / https://age-encryption.org / https://filippo.io/newsletter

🕳️ “Gaze not into the abyss, lest you become recognized as an abyss domain expert, and they expect you keep gazing into the damn thing.” —Nick Mathewson (npub18ky…l6yq)

Location: Rome 🇮🇹
Pronouns: he/him
Website: https://filippo.io
Twitter: https://twitter.com/FiloSottile

Public Key

npub1jzt0dcdqdhz0dmf3xk8fjn56kt45dqemtaz6rqzm9ycyz25p0nzqryjnwm

NIP-05 Address

filippo_at_abyssdomain.expert@momostr.pink

Profile Code

nprofile1qqsfp9hkuxsxm38ka5cntr5ef6dt966xsva473dpspdjjvzp92qhe3qprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmnt37uspf

Publishing to

relay.momostr.pink

Author Public Key

npub1jzt0dcdqdhz0dmf3xk8fjn56kt45dqemtaz6rqzm9ycyz25p0nzqryjnwm

Show more details

Last Notes

2026-04-23 15:06:12 UTC

- reply

can Geomys just sponsor 3x 700GB SSDs (RAID1 with spare) for you to run a prod Sunlight? I am deadly serious!

2026-04-23 13:42:06 UTC

How much storage / bandwidth / CPU / memory does it take to run a production Sunlight CT log? Surprisingly little!
There's now a public stats page, pulled every 5m from our Tuscolo prod metrics.
https://stats.sunlight.geomys.org/
Less than 2 cores, 300 MB of memory, ~250 Mbps of bandwidth, 260 GiB of SSD.
https://cdn.masto.host/abyssdomainexpert/media_attachments/files/116/454/308/251/297/764/original/fa07107842e1f9e8.png

2026-04-15 12:51:01 UTC

I wrote up in the TLS mailing list why I think composite signatures (ML-DSA + ECDSA/RSA) are a net negative, will hurt the ecosystem, and should not be implemented.
Hybrid key exchange was simple and self-contained. Hybrid signatures would be a mountain of complexity in code responsible for half of sev:crit in crypto libraries since 2020.
https://mailarchive.ietf.org/arch/msg/tls/oh3jmmkHzHdp1hk4R4M9QjkmvBk/

2026-04-11 00:15:30 UTC

Alright, it's official! 💰
[@matthew_d_green](https://ioc.exchange/@matthew_d_green ) and I bet on what will break first, ML-KEM-768 or X25519. The loser donates to a 501(c)(3) picked by the winner.
If you have an opinion on quantum computers or lattices, you can join with a side bet. Just submit a PR!
https://github.com/FiloSottile/ecc-vs-lattices-long-bet
https://cdn.masto.host/abyssdomainexpert/media_attachments/files/116/383/186/419/029/354/original/3a50e62fd0c6b1da.png

2026-04-06 15:14:07 UTC

Two papers came out last week that suggest classical asymmetric cryptography might indeed be broken by quantum computers in just a few years.
That means we need to ship post-quantum crypto now, with the tools we have: ML-KEM and ML-DSA. I didn't think PQ auth was so urgent until recently.
https://words.filippo.io/crqc-timeline/

2026-03-26 15:43:15 UTC

Last year, my position was that we still had time to design PQ authentication mechanisms.
Now, based on the pace of progress and on statements like Google's, I believe:
1. we need to finish rolling out PQ key exchange yesterday
2. we need to start rolling out PQ auth now
3. it's too late to ship any new non-PQ design or system
https://blog.google/innovation-and-ai/technology/safety-security/cryptography-migration-timeline/

2026-03-20 16:16:00 UTC

- reply

I can migrate to Pleroma/Akkoma without losing my posts?

2026-03-20 16:09:56 UTC

So uh, apparently $288/year is not enough to run a Mastodon service for ~3 users, and this is a known issue (https://masto.host/mastodon-content-retention-settings/) with no solution (https://github.com/mastodon/mastodon/discussions/19260)?!
I just want to own my identity. On Bluesky, it takes a TXT record and a did:plc rotation key. A PDS takes like $25/yr. For $300/yr you can run a whole-network relay.
Also, it's unclear if I can move to non-Mastodon software without losing all my posts, despite owning the domain??
And this ecosystem sneers at atproto?
https://cdn.masto.host/abyssdomainexpert/media_attachments/files/116/262/370/987/395/643/original/51a35ef3b712e7ff.png

2026-02-20 19:56:26 UTC

Dependabot security alerts have terrible signal-to-noise ratio, especially for Go vulnerabilities. That hurts security!
Just turn it off and set up a pair of scheduled GitHub Actions, one running govulncheck, and the other running CI against the latest version of your dependencies.
Less work, less risk, better results!
https://words.filippo.io/dependabot/?source=Mastodon

2026-02-16 13:35:07 UTC

- reply

Anyway, read Russ Cox's take on AI tool use in the Go project.
https://groups.google.com/g/golang-dev/c/4Li4Ovd_ehE/m/8L9s_jq4BAAJ

2026-02-16 13:35:07 UTC

- reply

One could go on!
Do you fully trust third-party dependencies?
Do you always verify third-party dependencies?
But somehow AI output is special and harbinger of all security issues.

2026-02-16 13:35:07 UTC

I wish that those surveys so often cited by InfoSec pundits that ask
Do you fully trust AI output?
Do you always verify AI output?
also asked
Do you fully trust your colleagues' output?
Do you always verify your colleagues' output?
Just to have comparative numbers, you know.

2026-01-30 12:22:55 UTC

I replaced eight different 5V, 12V, and 20V power supplies (for network gear, ext. hard drive, Milk-V board, air monitor) with two large USB-C ones (and various USB-C PD trigger cables).
It might be the most satisfying thing I've done all year.

2026-01-24 11:59:16 UTC

- reply

I was indeed just venting about an annoying but manageable situation, thank you for the offer and for picking up on the intention :)

2026-01-23 22:25:34 UTC

A wonderful twist on being an open source maintainer is when the person engaging poorly and violating the CoC is a security reporter with some valid observations.
You now have conflicting responsibilities to users' security and to your and your community's safety.

2026-01-04 15:48:35 UTC

Do you have an idle cluster? Can you spare a couple core-years?
Help me bruteforce some test vectors for RSA key generation edge cases!
Here are the instructions, it's just a matter of running a single self-contained cross-compilable Go binary that will report the results autonomously.
https://gist.github.com/FiloSottile/19e7ceb1fdcdaa128f7d3319ad0939fa

2026-01-02 17:39:02 UTC

- reply

I am the only one that can access the exe.dev account. Thank you for your concern.

2026-01-02 17:35:41 UTC

- reply

1. yes. by using it.
2. yes, I trust I will survive
3. the code is not public???

2026-01-02 17:16:41 UTC

- reply

I care deeply about the open source ecosystem, so I feel the argument that disposable personalized software is by definition not shared or reused.
However, let's be honest here: I would not have built this without LLMs, and no one was going to open source a FIPS 140 backoffice manager.
This only displaced a spreadsheet, a local script, a Google Drive folder, a bunch of emails, and error-prone manual processes.

2026-01-02 17:16:41 UTC

I just completely vibecoded with exe.dev and Opus 4.5 a backoffice for our FIPS 140 validation, with a separate view for the lab (where they can also upload test vectors), public links for clients, guided scripts for testing, and APIs to upload test results to S3.
I have not looked at the code once. It works great.
I am... processing this.

2026-01-01 13:05:52 UTC

- reply

This is what the Go team does, too, and we are similarly sad about the made-up scores being taken seriously.

2025-12-27 22:44:30 UTC

💥💥💥💥💥 age v1.3.0 💥💥💥💥💥
Post-quantum keys, seeking DecryptReaderAt API, age-inspect CLI tool, built-in recipients compatible with hardware plugins, non-interactive passphrase input, Go framework for implementing plugins, and sooooo many improved errors.
Our best release yet, six years to the day after the first beta, again released from the floor of #39c3!
https://github.com/FiloSottile/age/releases/tag/v1.3.0
https://cdn.masto.host/abyssdomainexpert/media_attachments/files/115/793/950/663/179/629/original/fe91f9803674021d.jpeg

2025-12-27 16:31:33 UTC

At the https://gpg.fail talk and omg #39c3
You can just put a \0 in the Hash: header and then newlines and inject text in a cleartext message.
Won’t even blame PGP here. C is unsafe at any speed.
gpg has not fixed it yet.
https://cdn.masto.host/abyssdomainexpert/media_attachments/files/115/792/484/165/073/814/original/62c310403495b926.jpeg

2025-12-24 15:14:38 UTC

After reading https://commaok.xyz/ai/just-in-time-software/ I gave exe.dev a shot and the combination of cheap VMs, the HTTPS proxy with passkey auth and link sharing, and the built-in LLM agent is... incredible.
Like, I know how to use each of these things individually, but combining them feels like when I first learned to script things.

2025-11-24 21:27:14 UTC

This Bernstein crap drives me up the wall because IT MAKES NO SENSE.
Why would the NSA be picking weak crypto to protect US NatSec?!
They have mathematicians and clusters in China, too!
Dual_EC_DRBG was a NOBUS backdoor. There is NOWHERE to hide a NOBUS backdoor in ML-KEM. Look at the code, there is nothing even remotely public key shaped.

2025-11-19 10:14:07 UTC

So tempted to write a troll thread on how this incident shows Rust has bad error handling and wouldn’t have happened in Go, where we actually handle errors 🫣🫢😜
https://blog.cloudflare.com/18-november-2025-outage/#memory-preallocation

2025-10-26 14:02:47 UTC

- reply

Going live on https://www.twitch.tv/filosottile in 30 minutes! 🔴
Join me for some Go livecoding of the post-quantum signature scheme ML-DSA!

2025-10-26 11:59:30 UTC

- reply

Alright, I put together a field implementation for the base ring using simple Montgomery multiplication, so we'll not have to worry about that part.
Will probably stream the actual ML-DSA implementation in the CET afternoon.
Give https://words.filippo.io/kyber-math/ a read if you want to come prepared!

2025-10-26 00:55:23 UTC

I've added an appendix to my "Enough Polynomials and Linear Algebra to Implement Kyber" article with the little extra needed to implement Dilithium/ML-DSA.
https://words.filippo.io/kyber-math/#appendix-a-bit-more-for-ml-dsa
Maybe I'll stream an ML-DSA implementation tomorrow at https://www.twitch.tv/filosottile.

2025-09-19 13:58:56 UTC

"Lack of scalability is enough for us to disqualify QKD outright: if a technology can’t bring security to the whole Internet, we’re not going to spend much time on it."
Quantum Key Distribution (as opposed to post-quantum cryptography) has a number of problems, but this succinctly captures the core issue.
https://blog.cloudflare.com/you-dont-need-quantum-hardware/

2025-09-16 01:33:16 UTC

Anytime I read something like “10,000 requests in a few hours” or “one million requests in a week” I‘m immediately skeptical of the framing.
That’s ~0.5 rps and ~1.7 rps, respectively. The disposable vape on HN right now claims 6.25 rps (160 ms page loads).

2025-08-31 13:54:02 UTC

There's a bit of commotion on Lobsters because an unpleasant-but-technically-correct user finally got banned, and I realized that an unpopular opinion of mine is that moderators are always right.
I don't care about the letter of the CoC. I don't care about transparency, even. Moderation is the fundamentally human and nuanced big-picture job that shapes a community.
https://cdn.masto.host/abyssdomainexpert/media_attachments/files/115/123/712/178/230/773/original/42748b9cdd676f14.png

2025-08-31 13:54:02 UTC

- reply

Sometimes mods will do something I wouldn't have. I'll never know because I will never have the full context, but even then they're not wrong.
They are shaping the community. If I don't like it (e.g. choosing borderline assholes over the rest of us), it's just not my community.

2025-08-13 16:07:51 UTC

I edited my Cross-Site Request Forgery countermeasures research into a stand-alone article, including recommendations reusable by other projects.
tl;dr: no need for tokens or keys, modern browsers tell you if a request is cross-origin!
https://words.filippo.io/csrf?source=Mastodon

2025-07-17 11:00:13 UTC

This is pretty well executed phishing.
The Copy button copies to the clipboard
echo "Y3Vy[...]ggJg==" | base64 -d | bash
which in turn curls this script https://gist.github.com/FiloSottile/385137f5ca2eabb51fd206bde2ff1d0a into bash.
They even detect piping, so to read it you have to run "curl | cat".
https://cdn.masto.host/abyssdomainexpert/media_attachments/files/114/868/224/746/439/839/original/67b6eec46293826c.png

2025-07-08 18:23:39 UTC

Operating a Certificate Transparency log is now within reach of many organizations.
I wrote up the requirements: essentially one small server process, a couple people, and the capacity to host 3-5 TB of static files. https://words.filippo.io/run-sunlight/
I'd love to chat with anyone who's considering running one!

2025-07-06 15:10:23 UTC

I released version 0.2.4 of Typage, the TypeScript implementation of age for Node/Deno/Bun and browsers.
encrypt and decrypt now accept and return ReadableStreams to encrypt/decrypt large files on the fly. The returned object also has an additional method to compute the expected output size from the input size.
https://github.com/FiloSottile/typage/releases/tag/v0.2.4

2025-06-30 16:11:12 UTC

I wish we had spaces to collaborate on technical work where being a jerk was just not allowed. Like, actual proper fearless moderation.
Your reply starts with "No." on its own line? Two weeks ban. Learn to behave.
You go on a tear about another participant? One year ban. No warning.
I'm a privileged white dude with 20k followers and even I hesitate to contribute to some spaces because of the mailing list hand-to-hand combat.
Imagine how many contributions by talented folks we are wasting!

2025-06-22 22:41:14 UTC

- reply

gee, trying new ideas for open source maintenance sustainability, I should consider trying that

2025-06-21 21:22:02 UTC

- reply

it’s not so black and white. If you are an unpaid maintainer you have no obligation to put in extra work, for sure. But if you do take down the banking system of a country once (still not your fault!) and people tell you your library is broken… I think you start having a responsibility to either deprecate it, fix it, or at least warn users. We live in a society.

2025-06-21 18:29:26 UTC

Looks like the same poorly implemented Android CT library that broke a lot of apps a couple years ago... did it again 🤦‍♂️
https://github.com/appmattus/certificatetransparency/issues/143#issuecomment-2993688741

2025-06-09 09:52:45 UTC

The Sketch blog has become the one thing you need to read—along with @npub1gv2…tlwl—to keep the pulse of LLM-assisted development.
Senior engineers putting in the work and giving no-bullshit perspectives.
Read this one by @npub1zlv…lytv through. Not skim. Not half. Especially if you are a skeptic.
https://sketch.dev/blog/programming-with-agents

2025-06-07 21:11:08 UTC

Another nice use case for Fetch Metadata headers (which we used for anti-CSRF in the last episode): server-side analytics.
On the client-side, any rendered HTML is a browser pageview, but on the server-side how do you tell pageviews from API calls from resource loads?
Sec-Fetch-Mode: navigate!
https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Sec-Fetch-Mode
I'm a fan of server-side analytics because they are more accurate, they don't waste client resources, and let you also count things like redirect URLs pointing to other sites.

2025-05-25 11:32:29 UTC

Fascinating retrospective read on an iOS exploit, but the most interesting part might be the Aftermath section.
Apparently Apple shifted gears with iOS 14 and started implementing deep mitigations, which despite not perfect really changed the game.
https://blog.siguza.net/tachy0n/#:~:text=4.-,Aftermath

2025-05-20 22:08:34 UTC

If Certificate Transparency logs were available as torrents, would you help seeding them?
If so, with how much storage and with what client?
I’m not sure how we’d update the torrent as the log grows. Does BEP 38 deduplication work with RSS feeds?

2025-05-19 19:07:59 UTC

Three Trail of Bits engineers audited the core Go cryptography packages for a month, and found only one low-sev security issue... in the legacy unsupported Go+BoringCrypto integration we're replacing! 🍾
Years of team efforts on testing, limiting complexity, safe APIs, and readability have paid off! ✨
Yes I am taking a victory lap. No I am not sorry. 🏆
https://go.dev/blog/tob-crypto-audit

2025-05-08 12:01:25 UTC

The AWS team published a key-committing variant of XAES (https://words.filippo.io/xaes-256-gcm/)!
Still FIPS-compliant, and with a proof.
Key commitment ensures the ciphertext can only be decrypted with one key, to avoid issues in higher-level protocols.
https://eprint.iacr.org/2025/758.pdf

2025-05-02 21:36:51 UTC

Running a full-network Bluesky relay costs less ($19) than my beefy but ~single user Mastodon hosted instance ($24).
People underestimate how much data optimized software can move through efficient protocols on modern non-cloud hardware.
https://whtwnd.com/bnewbold.net/3lo7a2a4qxg2l

2025-05-02 21:36:51 UTC

- reply

The relay is the supposedly centralized part of Bluesky because “too big” to run! $19/month!
The bsky.app AppView is bigger but every Mastodon instance is an AppView (and PDS), and if you were ok with Mastodon-style partial views of the network, AppViews would be cheap too.

2025-05-01 17:40:27 UTC

Here's something counterintuitive to non-practitioners: curve P-521 is often less secure in practice than curve P-256.
The latter is more popular, and so better tested. The risk of implementation bugs dwarfs the risk of partial cryptanalysis of ECC, so picking P-521 optimizes for the wrong thing.

2025-04-22 09:17:16 UTC

I am writing an application that really cares about durability of created files (a Certificate Transparency log), and... oof.
I fsync the file. I fsync the directory. Ok.
But... how do I test it? Even targeting a specific filesystem, I have to make VMs and try to race killing them?

2025-04-19 10:30:45 UTC

Oof. Reportedly, if you got a certificate from SSL.com by putting “example[@]gmail.com” at _validation-contactemail.example.com, they would add gmail.com (!!!) to your verified domains.
A good reminder to use the CAA record, and to sign up for CT monitoring (e.g. Cert Spotter).
https://bugzilla.mozilla.org/show_bug.cgi?id=1961406

2025-04-10 09:57:50 UTC

OpenSSH 10.0 (a regular bump from 9.9) is out, and it makes the post-quantum ML-KEM hybrid mlkem768x25519-sha256 the default. https://www.openssh.com/txt/release-10.0
The next release of x/crypto/ssh will support it, too, when used with Go 1.24, making SSH sessions quantum resistant! ⛓️ https://go.dev/cl/646075

2025-03-21 09:22:48 UTC

It’s disheartening to see AI reactionism lead my community to a 180° on copyright.
Everyone is merrily attacking LibGen now. If it didn’t exist, big tech companies would still find training data, it just wouldn’t be accessible to regular people.

2024-12-11 19:12:39 UTC

Would you pay for Cryptography Dispatches? I am considering using Buttondown's new per-email subscriptions to trick myself into writing more in 2025.
This would be voluntary. Max 1–3 issues per month.
There would be no subscriber-only issues. What you get for your money is motivating me to write more, if that's something you like.
Conversely, this would not be a major source of income. What I get out of it is tricking my brain into doing more writing by setting up a reward system.

2024-12-05 21:30:22 UTC

I wrote up how my NAS is now just a big initramfs based on Alpine Linux.
It's been pretty great. Immutable, declarative, and very very simple. Just some files, a list of packages, and a short script.
Turns out you don't need overlays, or special DSLs.
https://words.filippo.io/dispatches/frood/?source=Mastodon

2024-11-23 14:16:29 UTC

- reply

only when you poll it though, right? And here I would only query it manually.

2024-11-23 14:11:56 UTC

- reply

Hmm, it occurs to me that what I need is probably all in node_exporter already. Is there such a thing as a web UI for instantaneous Prometheus metrics?
i.e. a web service that just does a single poll of a Prometheus endpoint, and shows you the current values of the available metrics, with no history.
Hell, maybe even a CLI that I point to the remote Prometheus endpoint.

2024-11-23 13:52:05 UTC

Is there an open-source web UI for servers that displays system information like pstree, zpool status, fdisk -l, df, ip addr, etc?
I want it to just show current info about the machine it's running on, not rely on a metrics pipeline.
Ideally it would be read-only, extensible, and a single-binary Go program, or something as simple to deploy.

2024-10-12 20:12:39 UTC

"On behalf of the WordPress security team, ..." and then many mentions of "fixing a security issue" without specifying what it is. (The patch is, presumably, public since the plugin is OSS and PHP?)
https://wordpress.org/news/2024/10/secure-custom-fields/
I don't have an opinion on the broader Wordpress situation, but seeing a security exception used to wield power in a broader controversy is extremely worrying.
Open source communities trust security teams with exceptional powers, and weakening that trust damages everyone.

2024-09-19 15:03:10 UTC

Cat's out of the bag: I am pursuing a native FIPS 140-3 validation for the Go standard library.
Trying to do it right, making it seamless and without compromising on security.
First time a Go module is validated. Wish me well. And consider sponsoring!
https://go.dev/issue/69536

2024-09-16 13:35:58 UTC

Oh shit the vDSO implementation of getrandom() landed in Linux 6.11.
Might remove one of the last performance objections ot using the kernel CSPRNG for everything, the syscall overhead.
I have a large CL chain for crypto/rand, might as well add support for that...

2024-09-15 14:58:59 UTC

I use restic to backup my MacBook but I increasingly feel like it's not integrated enough into the system. For example it doesn't use APFS snapshots to make atomic backups, and doesn't download missing iCloud documents.
Are there robust solutions to all this? Happy to pay for commercial solutions but I would like to still end up with plain restic backups.

2024-09-12 09:04:30 UTC

I would like to pay $250, or $500 to a 501(c)(3) of your choice, for anyone to update the Dash for macOS [1] RFC docset [2]. See [3]. Any takers?
EDIT: Done! https://s.waq.dk/@Tenzer/113124619204569421
[1]: https://kapeli.com/dash
[2]: https://github.com/Kapeli/Dash-User-Contributions/tree/master/docsets/RFCs
[3]: https://github.com/willnorris/rfcdash/issues/10

2024-09-06 11:07:14 UTC

Hey all, I turned 30 this week! 🎈
I feel a bit weird asking for a "present" but if my code, writing, or talks reached you over the years, I would love to receive a postcard from wherever you live 📮
Open source is deeply rewarding, but sometimes I miss a physical reminder of the people on the other side of the wire ✨
Also, if you mention in the card making a donation to a US 501(c)(3) that aligns with my values, I will match it!
Mailing addresses, both US and EU: https://filippo.io/#addresses
https://cdn.masto.host/abyssdomainexpert/media_attachments/files/113/090/223/920/873/152/original/56b10982413b7a3d.png

2024-09-03 16:44:40 UTC

A couple notes about the Infineon timing side channel affecting most YubiKeys.
1. yubikey-agent is unaffected in the evil maid threat model as the attacker needs physical access *and PIN*
2. lol, Infineon
3. Go mitigates timing side-channels in ECDSA nonce inversion by not being clever and just using Fermat's little theorem, which is as simple as a constant time exponentiation by p - 2 (which can be optimized with @npub18qv…vtfq's addchain)
https://ninjalab.io/eucleak/
https://www.yubico.com/support/security-advisories/ysa-2024-03/

2024-08-05 22:35:26 UTC

- reply

pq key exchange is urgent because of store-now-decrypt-later, pq auth is not, it makes sense

2024-08-05 22:19:49 UTC

- reply

I’d argue PuTTY is just wrong. No one should use DSA keys, Ed448 is mostly unimplemented, and what does EdDSA even mean as a separate option.