chrysn

🏳️‍🌈 Technology enthusiast with a focus on Free Software and embedded systems. Science fiction promised us general purpose electronics, let's build them! (And get their security properties right.)

Website: https://christian.amsuess.com
pronouns: he/him
Other metadata for machine consumption: searchable (eg. through tootfinder), chrysn (npub1st5…9zp6)">https://justmytoots.com/chrysn (npub1st5…9zp6)
Also contributes posts to: Ariel OS (npub1e3m…8juh), [@RIOT_OS@floss.social](https://floss.social/@RIOT_OS ), [@endor_creative](https://chaos.social/@endor_creative ), Flachwitz (npub10nn…74z8)

Public Key

npub1st5k4cl9vwxme9afyh2z6n08vwn06wfg2ypud62k30hsmrrrdyvs299zp6

NIP-05 Address

chrysn_at_chaos.social@momostr.pink

Profile Code

nprofile1qqsg96t2u0jk8rduj75jt4pdfhnk8fha8y59zq7xa9tghmcd333kjxgprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmnt5vayw2

Publishing to

relay.momostr.pink

Author Public Key

npub1st5k4cl9vwxme9afyh2z6n08vwn06wfg2ypud62k30hsmrrrdyvs299zp6

Show more details

Last Notes

2026-08-13 08:10:39 UTC

- reply

I2P and Onion have the downside that if the key is found with you in a sting (or on protocol failure), you're cooked; some of that can be mitigated by offline signed artifacts (I don't know a URI pattern that uses them, but I don't know them all; probably Tahoe's pb:// URIs can do that).
Point is, there's a variety of options (including RFC4145 tag: URIs that are DNS based but kind of expiration-proof) that share a common format, and authors can pick what works there.

2026-08-13 08:03:56 UTC

- reply

DIO?
Not all URLs are DNS based, and not all all are dereferenceable. Completely unlinked ones are RFC6920 hash URIs such as ni:///sha-256;UyaQV...O2X_-Q (for immutable content) or UUID URIs such as urn:uuid:f81d4fae-...91e6bf6
(untraceable, mutable, but as with an ISBN, anyone can produce a new version and claim it's an update). Authenticated decentral URIs such as http://hexhex.onion/manifest or http://foo.i2p/manifest solve that, with some caveats, including https://www.ietf.org/archive/id/draft-bormann-t2trg-deref-id-03.html

2026-08-11 06:29:44 UTC

- reply

Maybe the thing this needs is not a technical solution, but a symbol or convention on how ISBN-like longlived URIs. Similar to how fediverse URLs are diverse as fedi (beyond the https://), but universally recognized by the pentagramgon, or the melephant.

2026-08-11 05:39:38 UTC

- reply

Why not just plain URLs? Properties that differ from ISBNs are that
- people don't instantly recognize them as permanent identifiers (but a new system would face the same)
- people might enter them into a browser (but that's not a bad thing, see DOIs)
- they're not constant length (but our modern databases can handle that).
Examples:
- urn:isbn:0-395-36341-1
- https://id.endor.at/26530
- http://xmlns.com/foaf/0.1/
- urn:nbn:de:bvb:91-diss20060308-1417541491 (see https://www.dnb.de/DE/Professionell/Services/URN-Service/urn-service_node.html)

2026-07-09 22:32:38 UTC

- reply

Adree on better doing single-stack right. But why DNS64 over PREF64? AIU, a system resolver can provide all the translated answers by processing PREF64 after having validated DNSsec (including sensible results for getaddrinfo(AF_INET6, "1.2.3.4", ...)), and applications that do everything in userspace won't get the benefits of DNS64 either (typ. because of their 8.8.8.8 DoH server).

2026-06-25 10:37:17 UTC

- reply

Looks cool but I'd need to issue COSE tokens (CWT) for @npub1e3m…8juh -- but maybe I can learn from your HSM support :-)

2026-05-05 20:49:56 UTC

- reply

Hab nicht alles verstanden, was es tut, aber: Sollten zwangstrennende ISPs irgendwann mal anfangen, das Richtige tun zu wollen, aber von der Zwangstrennung nicht wegkommen, und vom neuen Präfix auch nicht (störert ja nicht), und dann sobald sie merken, wer das ist, das alte Präfix wieder hinrouten (als deprecated), sodass alles fast aussieht wie kurzer connectivity loss während einer renumberings aussieht: Stört der Fix dann?

2026-05-02 08:48:29 UTC

- reply

Apple hat doch sicher eine Rechtsabteilung für sowas...

2026-04-24 12:18:57 UTC

- reply

I have no clue about streaming, but if it's the typical Rust crowd: you miss a tpyo, someone chats "s/tpyo/typo/", you say thanks and fix it and merrily stream on.

2026-04-21 11:22:00 UTC

- reply

Das /64, das Handys ausgeben, ist mVn keine PD, sondern kommt via RFC7278 <https://datatracker.ietf.org/doc/html/rfc7278>, da ist's schwer, mehr rauszuholen.

2026-04-18 14:20:48 UTC

- reply

It's fine that everyone can publish drafts. Those come with a clear disclaimer:
This document is an Internet-Draft (I-D). Anyone may submit an I-D to the IETF. This I-D is not endorsed by the IETF and has no formal standing in the IETF standards process.
Trouble is people misrepsenting them as IETF plans. If that were a news article, I'd suggest having a with the "journalist". But it's Facebook posts, so what'd you expect...

2026-04-09 12:26:33 UTC

- reply

In my ideal web, this would be a single image with progressive loading (JXL?), whose metadata indicates that it is composed of different panels (each of which has image descriptions of their own) that can be zoomed to sequentially; clients that don't understand that show the full image, those that do show it as sequence depending on the user's preference.
Until that works, I find 4-pictures more practical.

2026-03-25 20:26:24 UTC

- reply

I'm all for migrating off GitHub, but this looks like an odd item to peg it on: From your description, it only affect usage that is *already* using Copilot, and frankly, if I were using anyone's AI tools, I'd be surprised if it was *not* using its users for data collection.

2026-01-28 07:09:29 UTC

- reply

I don't think you can get rid of that big core switch, but would be delighted to be shown wrong.

2026-01-27 21:24:34 UTC

- reply

I think in general you can't, you'll need methods like
fn as_service(&self) {
match self {
MyThing::A(a) => Service::APrime(a.into()),
...
}
}
etc.
If you don't want to create them on foot, macros make this reasonably easy.

2026-01-05 10:00:18 UTC

If you still have your project on GitHub and think that it is a public project, try this: Log off (eg. using a private tab), go to your project, and try reading 3-4 issues. Chances are you're Too Many Requests'd for a few minutes before you even got a decent overview of the project's state. Is this then still a public project?
(For comparison, #Codeberg might run you through a round of Anubis, which is not great either, but still way better, and they run on a tiny fraction of MS's budget.)

2026-01-02 08:55:30 UTC

- reply

Gibt's von der Graphik eine Variante, die nicht völlig biased gegen #IPv6 ist (in der zB Probleme durch NDP Problemen durch ARP gegenübergestellt werden)?

2025-11-23 19:33:29 UTC

- reply

The one application group not covered by that argument are devices that have been v6 only already, relied on DNS64 so far and were not yet updated to read PREF64. But I guess that while those exist, they are niche enough that on those networks, DNS64 can be left running, maybe even selectively for those devices.

2025-11-23 16:09:38 UTC

- reply

I don't think we need DNS64 just because the alternative is 464XLAT. As long as applications use the system for DNS (eg. getaddrinfo), the OS can synthesize the equivalent of DNS64 from the PREF64. (For apps that do DNS themselves, there's a good chance they DoH anyway).
Then what remains as on-the-wire DNS64 is only used by OSes that don't process PREF64, and at least in v6mostly nets, they are in the fraction of legacy hosts that don't send option 108 and thus get v4 via NAT.

2025-10-20 19:54:02 UTC

- reply

`ls --sort time | head -n100 | xargs -n1 sh -c 'cat $0/.git/HEAD' | sort | uniq -c` gives me 45 main and 23 master for projects I touch regularly, and that ratio only gets stronger the less I extend this to ages old projects.
Looks pretty default to me, and the technical git default comes with a big yellow warning "hint: Using 'master' as the name for the initial branch. This default branch name is subject to change.".

2025-10-20 19:29:03 UTC

- reply

https://xkcd.com/1172/ ;-)
More seriously: Given how widespread the new default is by now, at some point there's a break-even between breakage from the change and users whose muscle memory needs constant overwriting forcing `master` instead of `main`, esp. when other ma- branches defeat tab complete. That break-even may just as well be now-ish.

2025-10-20 18:57:45 UTC

- reply

So what, it's just a branch rename, as has happened in many projects.
As long as they take care of any GitHub fallout (autoclosed PRs for lack of target) ... for a user in git, that's well managable.

2025-10-05 19:27:07 UTC

- reply

Zivilgesellschaftliche Organisationen kenn ich keine (nur technische), aber die Kollegys in Tschechien iaben da was vorgelegt: https://konecipv4.cz/en/

2025-08-31 10:06:41 UTC

- reply

No excuses for not copy-pasting code into alt. Still, please take a moment to thumbs-up https://github.com/mastodon/mastodon/issues/23981#issuecomment-2817128456 -- mastodon's lack of basic formatting, eg. using Markdown's ```html style syntax highlighted code blocks, is a major reason for many a needless image post.

2025-08-13 05:06:52 UTC

- reply

That's not jeopardizing your democratic image. It would be in jeopardy if after this round, there'd be contestation, a repeated vote, and that repeated vote would be cancelled and postponed due to faulty glue in ballots.
https://de.m.wikipedia.org/wiki/Bundespr%C3%A4sidentenwahl_in_%C3%96sterreich_2016 for reference.

2025-07-12 18:38:14 UTC

- reply

Do you have a link to a PR or issue that explains (or has the technical terms to look up) what happens concretely there?

2025-06-24 06:19:39 UTC

- reply

Having a remote sounds better because it is tracked; also, that'd enable getting data from there by other clients.
(E.g. I sometimes load files onto my laptop from a relative's NAS rather than my server just b/c their uplink has more bandwidth.)

2025-06-22 14:18:35 UTC

- reply

http://test-ipv6.com/ sollte das zeigen.

2025-06-22 13:46:03 UTC

- reply

Schaffen die Path MTU? Deren Disconter bob vergeigt da voll.

2025-06-17 07:09:05 UTC

- reply

Well, if it just says it's locking, then I think C already has a copy, it's just not locked, and locking is supposed to be fast so no need to elaborate by default. (There could probably be a different trust model where there is no LOCKCONTENT required; maybe if the remotes were trusted, that'd already suffice).

2025-06-17 06:33:56 UTC

- reply

What is your numcopies? Maybe it needs more copies than the new one to satisfy that.
And which remotes are trusted, semitrusted and untrusted?

2025-05-18 11:05:38 UTC

- reply

Are the recipients really in a better position to judge what the network state is? The negotiation for block sizes is already ... I wouldn't say brittle, but def'ly not well tested. Adding an extra option and protocol would best be done if there is a clear and benchmarked problem (which there may well be and I don't see it yet)

2025-05-18 10:32:13 UTC

- reply

Block size negotiation is mainly there to account for different supported MTUs in heterogenous 802.15.4 networks -- doesn't AX.25 provide that information already?

2025-05-17 16:01:18 UTC

- reply

Yes and no... they usually read tags from files, but as that's not a well usable data structure, they all build their media library in separate files anyway. Some gladly read external metadata, but sadly they don't even agree on formats there (some using m-tags, some extended m3u).

2025-05-17 15:45:15 UTC

- reply

Ok then I phrased it badly.
I never alter the binaries, I only add data in extra files that tell the next user how to use them.
E.g. for photos, that means having raw files checked into git-annex; darktable then stores cropping, exposure and white balance corrections in an extra file next to it (which I add into git).
I have not done this for music yet, but do plan to make my music player (mpd) look at the same kind of extra files (and/or @npub10gj…9lu4 ) to create its database.

2025-05-17 15:08:33 UTC

- reply

The perspective I take there is that when binary files are checked in, they're some kind of third party artifact that's immutable (b/c had I made it, it'd be versioned notes with playing instructions precise enough for reproducible builds, amirite?); own statements on how to best use them then go to versioned sidecar files.
I've done this for photos, but sadly don't have a workflow to share for music yet. (But minimally for films, there it looks like this: <https://gitlab.com/chrysn/films-metadata>)

2025-04-24 19:05:14 UTC

Don't trust security check websites.
I just went through 10 online #TLS checkers from <https://techarry.com/top-ssl-tls-testing-tools-open-source-online-scanners/>, and only 2 of them (<https://testtls.com/> and <https://www.ssllabs.com/ssltest/>) even managed to scan the #IPv6-only site I was scanning. For all the others: How do you expect to run a comprehensive test when you can't even resolve half the addresses?

2025-04-18 08:03:58 UTC

- reply

This is not specific to Python: it's the same in Rust and general mathematics. all(empty) is true and any(empty) is false.
This aligns well both with implementations (a la `for item in iterator: if item: return false` and eventually return true) and with the definition (there is not a single element in there that is false, so the result must be true).

2025-03-12 10:56:00 UTC

- reply

Eine Route wird's geben, aber mit Fehlern in der Path MTU Discovery.

2025-02-16 14:04:19 UTC

- reply

Kind of yes, but what would that mean for my vim modelines?

2025-01-20 13:36:41 UTC

- reply

My guess on this is that many tech savvy people try to get rid of printers for everyday tasks, leaving only a small community of print enthusiasts, and that is further fractured into the wide range of possible shapes (@npub1aw0…7ktg is doing plotter scale stuff with what may even be open hardware; @npub1v69…6vhl is more on the producing-a-book end of things, and there's a huge space in between even without getting started on colour).

2025-01-03 21:54:13 UTC

- reply

Thanks for the heads-up. We're posting [@RIOT_OS](https://fosstodon.org/@RIOT_OS ) stuff from there, but without any strong ties to that instance (other than, well, picking it from some list initially, especially when we were half-bot due to replication from another network, which we've long since stopped).
Do you have suggestions where else a FLOSS project might set up shop?

2024-11-21 11:55:14 UTC

- reply

Are Mementos (RFC7089) still a thing? Sounds a bit like the same thing but being more explicit about what happens.

2024-10-16 18:51:17 UTC

- reply

Leider ist "Oder ein Router dazwischen greift sehr heftig im Datenverkehr ein" nicht so unrealistisch, wie ich es gerne hätte.

2024-10-16 14:44:44 UTC

- reply

IIUC darf sich eine MTU über's Internet gerne mal ändern – Routen ändern sich nun mal, aber dann sollte eben ein ICMP Packet Too Big zurückkommen, die beteiligten nodes lernen das, gut wär's. (Wenn sich am Link zum host die Linklayer-MTU ändert, muss halt der eigene Kernel das gleiche Verhalten zeigen). Wenn die Packet Too Big nicht kommen, macht der ISP was falsch, wenn sie ignoriert werden (weil ja schon mal mehr ging), die Anwendung.
Jedenfalls stell ich's mir so einfach vor 🙂

2024-10-16 13:34:28 UTC

- reply

Wenn die Handynetzbetreiber IPv6 richtig hinbekommen, ist eh schon viel gewonnen. bob.at (und vmtl. auch A1) schaffen's nicht mal, ICMP-Messages zur path MTU durchzulassen, und machen die damit ganz kaputt 🤦
(Ich bin kurz davor, den Telekom-Regulator darauf anzusetzen, aber mglw. muss es dafür Vertragsbestandteil sein).

2024-10-09 09:35:40 UTC

- reply

I hope that as a Rustacean you also differentiate between checked security guarantees and causing a lot of fuss for a diffuse threat to ensure everybody knows you are Very concerned.
https://youtu.be/nrKvweNugnQ might help placing airport security more in the "encrypted with ROT13" category.

2024-09-25 22:09:03 UTC

- reply

Bei "die Herausforderungen sind natürlich sehr groß" war ich kurz vor'm Abschalten, aber sie bringt super, dass nun mal einfach die Unzahl an Einzelsystemen das Problem ist.

2024-07-30 07:03:13 UTC

- reply

Clearly not setuptools' fault, but in times of many processes running in CI, a consistent way for reporting deprecations is lacking. Python needs -Xdev to even show them on stderr; -W error::DeprecationWarning would be an extra run, and might then still not reach the setuptools process.
Is there any coordinated effort for collecting such deprecation warnings into CI reports across platforms and ecosystems?