Linus Gasser

Hobby cryptographer with a tendency to prefer decentralized stuff like the internet, email, Mastodon, and of course blockchains in a way or another.

Last Notes

2026-06-05 07:38:57 UTC

- reply

Here is a publicly available paper which shows how you can break the older version of the E2EE in Nextcloud:
https://ethz.ch/content/dam/ethz/special-interest/infk/inst-infsec/appliedcrypto/education/theses/nextcloud.pdf
Let's hope they fixed it :)

2026-06-05 07:37:58 UTC

- reply

Second this...
E2EE is a privacy feature, no? So why do I need to enter my PII to be able to read how you do it? That sounds wrong!

2026-03-05 16:23:54 UTC

- reply

Very nice figure - first I was confused, but then it made sense :)

2026-01-07 11:59:50 UTC

- reply

I just asked Claude what it thinks about our half-project report:
> Please play the role of an evaluator in the Innosuisse grant system. Write what you think when reading the report: are you convinced the project is on a good track? Do you agree that the project should be continued? What are dark spots where you think you would need more information in order to decide on a go/no-go?
It's answer was very direct and very critical :) But really useful.

2025-12-19 20:36:49 UTC

- reply

you probably already saw this, but just in case...
Are they aware of your poc for a PKI?

2025-06-20 07:01:22 UTC

- reply

I wanted to point out that the "exposure to untrusted content" is sometimes difficult to be separated from the "ability to exfiltrate".
So if you think "oh, there is no exfiltration possible, I 'just' fetch untrusted content", this fetching can actually already exfiltrate the content!

2025-06-17 13:22:24 UTC

- reply

Great article. You could summarize it by saying the "lethal duality", as "exposure to untrusted content" most often means "ability to externally communicate". Even if it is only by sending out a GET request to fetch the data. But that is enough to also leak your private data...

2025-05-01 14:45:29 UTC

- reply

Please prove me wrong :)
I even signed up to Cursor for 1 month but used all tokens in a couple of hours with very disappointing results. My goal was to write a backend/frontend app for a novel idea, but it didn't even created compilable code...

2025-05-01 14:44:01 UTC

- reply

Do you really believe vibe-coding is possible without programming knowledge? I tried most of them in March, and the result was quite depressing: if I didn't know my way around npm, rust, whatever, I couldn't have done anything.
Of course it's very nice to have these things generate some template code. But once the complexity reaches a certain threshold, LLMs seem so lost.
Let's hope that threshold rises, but currently I cannot fathom using them without programming knowledge.

2025-04-08 07:02:00 UTC

- reply

I was wondering how this compares year-to-year. But in fact this _is_ year-to-year, according to the article. In there they also discuss the possible effect of Easter, but then they compare US travellers with international travellers.
Verdict: US travel as before, international travel is down...
https://social.epfl.ch/system/media_attachments/files/114/301/057/069/348/321/original/3d98c6a6222195e2.png