2026-04-11T22:35:23Z https://yabu.me Sophie Schmieg https://yabu.me/npub10qaqswg07tsrztrauf69ylup6qj50kef7e4ut7t0vganygk0t2rsyr4hg8 https://media.infosec.exchange/infosec.exchange/accounts/avatars/109/344/095/365/925/622/original/b1885f96d2f55668.png https://media.infosec.exchange/infosec.exchange/accounts/avatars/109/344/095/365/925/622/original/b1885f96d2f55668.png https://yabu.me/nevent1qqsychp4h72tv8xjx9sh6c3sedpde8h66qw7jn2tjjfyd9zxrhpueuqzypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgw7use2v In reply to <a href='/nevent1qqsv2a5hvkdevsuumm9ftppcnswp5zyg8llfdp7cszpln077etqq4esggcae3'>nevent1q…cae3</a><br/>_________________________<br/><br/>it turns out, a random number generator does not get better when you first run it through a lot of linear algebra 😏 2026-02-25T21:05:29Z https://yabu.me/nevent1qqs88umkd0qf9aapw2squ9drwu95vanchyq2k3vj6h4ecl5ytds4gsgzypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgw7n4dhd And all of the sudden, we have solved supply chain security. <br/><br/>No CVE, no vulnerabilities! 2025-04-15T20:39:29Z https://yabu.me/nevent1qqsd9usshvh0g9s49sdnr2ae9tdh2pa24ql96l92vky0jds55uwed5qzypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwj3v0ny In reply to <a href='/nevent1qqs299spekvzpsgym8ds573zw6appmznvrdcsw8v78hkrf786mj853smewlnv'>nevent1q…wlnv</a><br/>_________________________<br/><br/>for small to medium sized businesses that are not doing anything more adventurous than TLS when it comes to cryptography, my advice would be, if there is some free engineering capacity, to turn on 0x11EC (X25519-ML-KEM768) in their TLS config, assuming their stack supports the cipher. (The various different stacks are adding support for that currently)<br/>That way, you can check if anything breaks, with both Chrome and Firefox negotiating that cipher by default, and Safari rolling out support for it. The main risk is with middleware breaking. <br/>In that threat model, it may not be the most urgent task, but it&#39;s relatively simple, depending on the used TLS stack. You can also turn on the equivalent KEX in SSH (supported in OpenSSH). Otherwise, in that threat model, I wouldn&#39;t do much at all (and even these two things are mostly optional, unless there are very strict long term confidentiality concerns).<br/>Of course, if your threat model is more adventurous, you might want to hire some cryptographers 🙂 2025-03-29T14:30:41Z https://yabu.me/nevent1qqswvw8u8tg2spl804swhgykw29v89xcc03cdumarqx3a9s9cg63suszypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwvjcgf6 Days since Signal&#39;s deniable handshake has last been defeated by nobody caring about cryptographically deniable handshakes: 0 2025-03-26T05:33:09Z https://yabu.me/nevent1qqstzy6k6nkkv32zl6c967lymc89zfgsrccjw2zzgsapnttpwy39hdqzypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwvejl6g In reply to <a href='/nevent1qqsrztn7gn5wmdhp4pt0qk2zp8q0ft29p5h8ywar962ty386m8t5ktqnu2xpv'>nevent1q…2xpv</a><br/>_________________________<br/><br/>hmm? Signal uses different colors for different people, that helps me distinguish chats fairly well. 2025-03-25T08:27:43Z https://yabu.me/nevent1qqsgz5dvkqxz5g5glunc8gqm3pkduaankeknp60gxg46egmt0mh529czypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwk5lh45 In reply to <a href='/nevent1qqs85r89x9wudh4m2kd5q85gt8aes0jrs8q5qxdqs8ns4xsgqsa068c0ag0aj'>nevent1q…g0aj</a><br/>_________________________<br/><br/>I don&#39;t back down from bullies. And I need to travel internationally to do my job. If that becomes infeasible, I will have to leave the US and move back to Europe. I can much more easily skip conferences in the US (a good chunk of which are organized by the federal government to begin with), then I can skip international travel. And a lot of my peers in industry and academia are in the same position. 2025-03-18T19:37:38Z https://yabu.me/nevent1qqsg5f27y3m60a705s6cxt5crrrqfhh3c77q9mu6j0t045hzg8w0uaqzypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwe072jq Feeling great about my upcoming international travel right now.<br/><br/><a href="https://www.theguardian.com/us-news/2025/mar/18/germany-investigates-after-national-with-green-card-arrested-at-us-border">https://www.theguardian.com/us-news/2025/mar/18/germany-investigates-after-national-with-green-card-arrested-at-us-border</a> 2025-03-18T18:30:29Z https://yabu.me/nevent1qqsra25f56qw8hzk97zgye0y36zl79hcj8yrh5mzuah62g9pk7tr9lszypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwq2c8l9 In reply to <a href='/nevent1qqstm5j5mmzsvxl655kekfk8stgsvc36ge8jw34gau0l0q0x7ued8ggp99353'>nevent1q…9353</a><br/>_________________________<br/><br/>look at number fields, split, ramified, and unramified primes while you&#39;re at it. IMHO easier to understand and deeper than split complex or dual numbers (although the dual number construction is extremely important for algebraic geometry). 2025-03-18T16:39:16Z https://yabu.me/nevent1qqsf07j76389qaxv5k0supgc2lw6kfx70qf5y0f9zc8azwt5xdd9jlgzypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwjte7zn This was a really fun vulnerability to have the pleasure to consult on:<br/><br/><a href="https://bughunters.google.com/blog/5424842357473280/zen-and-the-art-of-microcode-hacking">https://bughunters.google.com/blog/5424842357473280/zen-and-the-art-of-microcode-hacking</a><br/><br/>It turns out AES-CMAC is not second preimage resistant if you know the key (double so if the key is in an RFC), and 2048 bit numbers are quite often very easy to factor. 2025-03-05T18:10:10Z https://yabu.me/nevent1qqs06p8tvj008jg94slhhenvf5ksr32cszdlt8gwsawd5j60fvv3g4czypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwka3q67 In reply to <a href='/nevent1qqsdhhzwcctm8cgckvjlvhmt8ehrgedh32k4kk70ppk2xk4ds23zhygt83e0h'>nevent1q…3e0h</a><br/>_________________________<br/><br/>be that as it may, it matters that the president cannot change the law via executive fiat. It is still illegal to bribe foreign officials. There might not be enforcement right now, and if you outrun the statute of limitations that might mean you are able to commit an illegal act without penalty. But it is still an illegal act, and you still committed a crime. 2025-02-11T16:23:48Z https://yabu.me/nevent1qqs0uw40dgdpx77qc06x8sk2cmyj3r8lps6c6y8u73c43s590668qpczypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwvfvxs7 In reply to <a href='/nevent1qqsdhd03cw6y6upf3ans4pdev37ecrgyxvyfs6flnf9hvmm5etmpt3s9nvzc9'>nevent1q…vzc9</a><br/>_________________________<br/><br/>executive orders cannot suspend laws passed by Congress. 2025-02-11T16:06:28Z https://yabu.me/nevent1qqsqp6q526k2wxyhvrh34whccplqd6w3r63kkyy4d9qv7575v29u7tczypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgw4yxtjv In reply to <a href='/nevent1qqs0dsr042xzk6z9r743mr9hmquseqzla9vcvvq5tmu2h0p84t0xwfgthmfgw'>nevent1q…mfgw</a><br/>_________________________<br/><br/>See this excellent blog post about a list of the problems and design issues with PGP.<br/><br/>And I do agree, at least some points also apply to Mastodon DMs, in general, retrofitting end to end encryption is not a simple undertaking, and usually leads to endless compromises that make the whole thing meaningless. <a href="https://www.latacora.com/blog/2019/07/16/the-pgp-problem/">https://www.latacora.com/blog/2019/07/16/the-pgp-problem/</a> 2025-02-03T18:38:16Z https://yabu.me/nevent1qqszw9a2h0jdn0qucy6zslu272umayswmvwjh253q5v9mqj2w94qz8szypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwlt6exu In reply to <a href='/nevent1qqs8cnxr2zkmxdkcsxgd5nszckdgl497ggngndwv09f26yxr3uxmtusrrapug'>nevent1q…apug</a><br/>_________________________<br/><br/>leopards, face, … 2025-02-01T02:11:21Z https://yabu.me/nevent1qqsw595chx02xle00m6c3cjzl5ldupvnmpzxgefp2ad5vzfeszjs8tszypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgw3dxysr In reply to <a href='/nevent1qqsxcs3wvktaktwqeq47haynfkwzwk87mcl3rgh5g9sdw54eafc0tsqqfh6e5'>nevent1q…h6e5</a><br/>_________________________<br/><br/>so far, there is still no evidence of person to person transmission. So I think for the moment the pandemic part 2 risk is contained. Let&#39;s hope it stays that way. 2025-01-06T22:26:11Z https://yabu.me/nevent1qqspgh9u3qfa4uzwjle4vfmqqu8dgtgydcxj85vajdza3dku79a95hqzypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwhawfcv In reply to <a href='/nevent1qqs9qgewpl93yt9eu0vwjlpkelfke6cdr984dc293clufkkfyncd8lgpg8nwe'>nevent1q…8nwe</a><br/>_________________________<br/><br/>In case you do not know how GenAI works, here is a very abridged description: <br/>First you train your model on some inputs. This is using some very fancy linear algebra, but can be seen as mostly being a regression of some sorts, i.e. a lower dimensional approximation of the input data.<br/>Once training is completed, you have your model predict the next token of your output. It will do so by creating a list of possible tokens, together with a rank of how good of a fit the model considers the specific token to be. You then randomly select from that list of tokens, with a bias to higher ranked tokens. How much bias your random choice has depends on the &#34;temperature&#34; parameter, with a higher temperature corresponding to a less biased, i.e. more random selection. <br/><br/>Now obviously, this process consumes a lot of randomness, and the randomness does not need to be cryptographically secure, so you usually use a statistical random number generator like the Mersenne twister at this step.<br/><br/>So when they write &#34;using a Gen AI model to produce &#39;true&#39; random numbers&#34;, what they&#39;re actually doing is using a cryptographically insecure random number generator and applying a bias to the random numbers generated, making it even less secure. It&#39;s amazing that someone can trick anyone into investing into that shit. 2025-01-03T20:54:00Z https://yabu.me/nevent1qqs9qgewpl93yt9eu0vwjlpkelfke6cdr984dc293clufkkfyncd8lgzypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgw4ezd63 I was forwarded this screenshot and it just is living rent free in my head right now.<br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/766/372/583/509/013/original/558b18b47adc8848.jpeg"> <br/> 2025-01-03T20:46:33Z https://yabu.me/nevent1qqsp8839jeylr5rrcmrhl9aczx3r9r2ltka4h62l9dthnfffzxzsn0gzypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwudq9cv The tradition is only known as &#34;the holidays&#34; to most, but it&#39;s important to remember what we are celebrating this time of year: the Herculean effort to fix the log4j vulnerability caused by needless use of JNDI. 2024-12-20T00:33:13Z https://yabu.me/nevent1qqsgnmfn0x0nauwyn5w4sywe3n8kz6gvyu8quydzystmzmvlnnn4lzgzypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwwq9r9l At this point, the IETF might require an anti-SLAPP rule, disallowing participants threatening other participants or the IETF with frivolous lawsuits from taking part in the standards process. 2024-12-13T16:14:36Z https://yabu.me/nevent1qqsw34k006ndwmv3336jufp27lt85l44skkyl9j4paan9wzvadn6ymczypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwecwgfq <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub184fq96hfzuehvlhsf5h06fdngce9y5t49gnh3d7y8ms7v3lmgw6q3apnjc" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Insecurity Princess 🌈💖🔥</span> (<span class="italic">npub184f…pnjc</span>)</a></span>, reviewing a resume, on a Saturday morning, while still in bed: this candidate&#39;s work experience is from September 2025 to present! <br/>Me: you should tell them they&#39;re hired, start date is November 10th 2024, three unexcused consecutive days of absence are considered a resignation. 2024-11-23T17:50:39Z https://yabu.me/nevent1qqs27t9qhp9wwcnnfxtte4tfdzvvvcgufp7mgw30pntxwy4fhyf6slqzypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgw6dh9pj Quote: &#34;We thought the internet was for porn, but it turns out it&#39;s for certificates.&#34; 2024-11-07T12:17:38Z https://yabu.me/nevent1qqsg924gl557j3cgsz9e4s70x5gyw9a6ptfnvzhr48a3pkze2xxcvxqzypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwq292yr In reply to <a href='/nevent1qqspdrm0d5k3s0tlg4ksr7kvfvnlglq6vp4zqts296t7p69rpanq0dc00mjf9'>nevent1q…mjf9</a><br/>_________________________<br/><br/>how about: <br/>1. Absorb the current state of the deck into SHAKE256.<br/>2. Run Fisher-Yates, by squeezing and rejection sampling the XOF output for the &#34;random&#34; numbers. <br/><br/>Slightly complicated to run in real life, but very easily extendable to a randomized shuffle by also absorbing some randomness in the beginning! 2024-10-09T22:09:02Z https://yabu.me/nevent1qqsddjvdkq2y7t0htmpljdceuyd0srpahcjajz0rgk5q6xd242pyhgczypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgw7macjv To correct the common misunderstanding:<br/>Eve (they/them), Alice (she/her), and Bob (he/him) are in a consensual, BDSM relationship, featuring Eve as service top, Alice as the bratty bottom, and Bob, who just likes to watch.<br/><br/>Their safe word is &#34;indistinguishability obfuscation&#34;<br/><br/>Eve only &#34;breaks&#34; Alice&#39;s encryption because she&#39;s super into it, not to cause harm. 2024-09-12T07:31:16Z https://yabu.me/nevent1qqswukpvcsfx7dzmhja4ge28qgdy273j6yqvmtwgfmvhvt5eatapyuqzypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwamgsmj Let&#39;s see if my vacation auto responder has harvested any good poems.<br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/109/160/658/222/725/original/2ac2b9882135dda3.png"> <br/> 2024-09-09T19:11:25Z https://yabu.me/nevent1qqsrhsnlzm47zwrxauskhusua2fwfymy835xftyk7j09lkq2swegclszypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwrjv2d8 In reply to <a href='/nevent1qqstcl98xfej3hse5xerjues2zxzzftv5wjlpw09pdeae5pmszapfjqkh73ph'>nevent1q…73ph</a><br/>_________________________<br/><br/>well, you do need proteins, but they don&#39;t know their worth, so they&#39;re all underpaid 2024-09-09T16:37:40Z https://yabu.me/nevent1qqsqwrsc9mpclnxazx0k7h27d0atsc8m2y2j9dje3wjlekxzylv3kjszypur5zpeplewqvfv0h38g5nls8gz237m98mxh30eda3rkv3zeadgwgprp2g When you think about it, you realize that DNA is the mother of all esoteric programming languages 2024-09-09T15:56:10Z