Soatok Dreamseeker

He/him. Gay/demi dhole (Cuon Alpinus) furry.

Blogger, programmer, security engineer, cryptography nerd. 30+

Too spicy for Twitter (banned with all the prominent journalists on 2022-12-16)

I don't represent any company, individual, or community.

Public Key

npub17uyfsxsnfgg6dgqazlfjv2gdl235mq0dug9wq6kjq9ngzh6pdyese4305p

NIP-05 Address

soatok@furry-engineer.mostr.pub

Profile Code

nprofile1qqs0wzycrgf55ydx5qw305ex9yxl4g6ds8k7yzhqdtfqze5ptaqkjvcpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsfzv2aw

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub17uyfsxsnfgg6dgqazlfjv2gdl235mq0dug9wq6kjq9ngzh6pdyese4305p

Show more details

Last Notes

2026-04-03 02:42:36 UTC

- reply

@nprofile…d0wl @nprofile…kxet I got flooded with people needling me with requests to give free audits to various projects and decided not to look at most of them

2026-04-02 23:50:48 UTC

- reply

@nprofile…kxet @nprofile…d0wl I found and disclosed a bunch of Conversations vulns a month or so ago, if that counts

2026-04-02 18:09:38 UTC

Jeez, what a mess.
https://www.404media.co/a-secure-chat-apps-encryption-is-so-bad-it-is-meaningless/

2026-04-01 04:35:41 UTC

- reply

If anyone goes to non-furry events with 1000+ attendees, pitch this to their board.
Let's make every event offer harm reduction.

2026-03-31 01:06:32 UTC

If you see someone posting a photo of a sign at a furry convention that advertises HIV / STI testing while sounding offended, it's a queerphobic dogwhistle.
Spread this to your friends/families to inoculate them from bad memes.
https://soatok.blog/2024/09/30/why-are-furry-conventions-offering-hiv-testing-to-attendees/

2026-03-23 22:04:12 UTC

Gee thanks, Blizzard.
https://furry.engineer/system/media_attachments/files/116/280/748/653/609/010/original/d33ab84a1809b3ea.png

2026-03-19 03:27:55 UTC

There are probably grown-ass adults who cannot get laid entirely because they're getting dating/relationship advice from ChatGPT.
And if this will probably become an increasingly prevalent issue.

2026-03-18 12:13:19 UTC

Banned from the Linux user group for saying "so this is like a kink thing, right?"
#FreeAsInFreeUse

2026-03-06 04:16:35 UTC

I'm not gonna say it
Just read this story
It says more about my point than I ever could
https://www.404media.co/proton-mail-helped-fbi-unmask-anonymous-stop-cop-city-protestor/

2026-03-03 23:35:54 UTC

- reply

I guess I should just tap the sign whenever I encounter this sort of personality:
https://soatok.blog/2026/02/25/cryptography-engineering-has-an-intrinsic-duty-of-care/

2026-03-03 14:33:56 UTC

- reply

@nprofile…zaxj @nprofile…v2v2 @nprofile…2a0g
To be fully transparent: I have turned down job offers before because I do not feel comfortable writing C. Almost everyone I've met that believes they can write secure C code is overconfident, and that scares me. So I'm certain that a better patch is possible.
That said:
You're going to get an invalid output if you proceed with invalid parameters. Silently aborting immediately versus allowing stack corruption is a losing position to be in.

2026-03-03 14:23:20 UTC

- reply

@nprofile…zaxj @nprofile…v2v2 @nprofile…2a0g Yeah, the existing codebase is not amenable to good programming practices. I'm going to recommend libhydrogen instead.

2026-03-03 13:52:41 UTC

- reply

@nprofile…v2v2 @nprofile…t3h7 @nprofile…2a0g Yeah but https://github.com/LoupVaillant/Monocypher/issues/285#issuecomment-3991233186 lol

2026-03-03 13:17:52 UTC

- reply

@nprofile…a8rk Our Threat Model is "You must only accept secure inputs if you want secure outputs".

2026-03-03 13:12:12 UTC

tfw you report issues, get dismissed by the maintainer, and then several other people go "wtf?" to the maintainer so you don't feel alone

2026-03-02 19:45:34 UTC

Loup-Vaillant wrote this on Lobste.rs:
Personally I would actively avoid the check,
Hmm. What a weird thing to say.
Loup-Vaillant wrote a cryptography library called Monocypher, which famously had an EdDSA vulnerability mostly caused by their insistence on rolling their own custom EdDSA variant to avoid SHA512.
"I wonder how Monocypher holds up in 2026?"
Who said that? Well, anyway:
https://github.com/LoupVaillant/Monocypher/issues/285

2026-03-01 02:45:47 UTC

https://squirrelly.blog/2026/02/28/alice-fucks-bob-with-help-from-amis/
Looks like my "disclose 0days via furry porn" idea has legs

2026-02-26 16:37:24 UTC

But still not physically old enough to have enough years of experience for most "entry level" job listings lol

2026-02-25 15:44:05 UTC

https://eprint.iacr.org/2026/058
Wow

2026-02-25 02:42:56 UTC

Y'know what's funny?
I spend a lot of time thinking about and working on technology to make it easier for folks to have privacy in their comms,
But most of my chats are like:
"awawawawawa"
[furry sticker]
[furry sticker]
[furry sticker]
"why are compilers, man?"

2026-02-22 21:28:37 UTC

- reply

If you care about FIPS (you probably shouldn't), you can't really use STREAM. But you can use FLOE.
https://github.com/Snowflake-Labs/floe-specification

2026-02-22 21:27:59 UTC

- reply

If you're wondering what would be better, it's called STREAM.
Libsodium implements it:
https://libsodium.gitbook.io/doc/secret-key_cryptography/secretstream

2026-02-22 21:24:16 UTC

Fun Matrix fact:
Attachments are encrypted with unauthenticated AES-CTR mode.
The only reason this can't get attacked is they store a SHA256 checksum (yes, really) in the Olm-encrypted message, and while the bottom layer of this is badly designed, it's protected from tomfoolery by higher layers.
Defense-in-depth? Never heard of 'er.
Matrix, probably

2026-02-22 05:30:02 UTC

- reply

What about JSON Web Tokens?
Listen: If you can make JWTs secure without reinventing Macaroons or PASETO, you deserve a Levchin fucking prize.

2026-02-22 05:27:48 UTC

- reply

But I like Matrix/PGP/MTProto and want it to be better!
Then: Get good.
I literally blog about applied cryptography for free. If you steal the info I've shared and use it to benefit projects I hate, I'll be none the wiser.
But if you do this, please don't fucking tell me about it.

2026-02-22 05:24:20 UTC

- reply

It's like PGP.
If I see a thing uses OpenPGP in any capacity, I immediately bail out.
Because I do not want even a second of my life to be wasted on helping spread the misconception that anyone should be using PGP.
Nor do I want to inadvertently make something built on PGP accidentally more secure by the nature of looking at it.
I'd rather it burns to the ground.

2026-02-22 05:10:39 UTC

Let me just put this out here:
If you're coming to me hoping to "mediate" between Matrix or even "win Soatok over"
You're wasting your fucking time.

2026-02-22 02:30:22 UTC

- reply

When this rolls out, your private messages on ActivityPub will be encrypted using post-quantum cryptography, if I have any say in the matter:
https://github.com/swicg/activitypub-e2ee/issues/59

2026-02-22 02:28:08 UTC

- reply

I think the only things really left to do to make them ready for real world deployments are:
Improve documentation
External work
External work meaning:
Write a FASP
Ensure other plumbing is in place for this to land
FEP-521a with Ed25519
RFC 9421 everywhere
And then I can shift gears to MLS-related work so folks can actually encrypt once they have public keys exchanged :D

2026-02-22 02:25:04 UTC

Tagged new releases for every repository in the Public Key Directory project
More test coverage
Found minor specification gaps and filled them
More robust deployments with SQLite
https://publickey.directory

2026-02-20 07:27:08 UTC

Something vexing:
I've got a lot of ideas for improving things, but they're mostly infrastructure / ecosystem projects.
It's very difficult to connect any of them directly to the things people insist they need today.
For example:
Key Transparency for the Fediverse
E2EE for ActivityPub can leverage this
AuxData is useful for other protocols
It's difficult to get most people to know or care about this!
But if you want a federated Discord replacement that can be easily self-hosted without making the host a juicy target for privacy invasions, and you don't want to require users to manually verify keys, this work is essential.

2026-02-20 07:02:52 UTC

- reply

The sword and spear were included mostly because my first doodles (circa 2011) looked like this:
https://furry.engineer/system/media_attachments/files/116/101/670/791/439/876/original/c809d68ea9b4eb0c.jpeg

2026-02-20 07:00:33 UTC

Speaking of which, did I ever share my reference sheet?
Artist: https://bsky.app/profile/ankey.bsky.social
https://furry.engineer/system/media_attachments/files/116/101/652/189/983/806/original/9e007cde61e50784.png

2026-02-20 06:54:32 UTC

If you've decided to follow me because of recent events, beware that I'm mostly not that interesting
I talk about my projects, privacy tech, and furry stuff.
I boost a lot of furry art. I make no apologies for this.

2026-02-20 04:01:29 UTC

- reply

@nprofile…h7sh It's built on OpenPGP, so I immediately bail out

2026-02-20 03:52:42 UTC

- reply

Matrix has many incentives to lie or mislead. Their leadership includes the CEO of a company whose product is a Matrix client. There's active political talks about the EU investing heavily in Matrix. He's got a vested interest in looking good, even at the expense of doing or even being good.
On the other hand, I have nothing to gain. If everyone switches to Matrix tomorrow, nothing in my life changes. If Matrix self-implodes and everyone goes back to XMPP tomorrow, nothing in my lfie changes.
The only things I want are:
End-to-end encryption to be better.
End-to-end encryption to become ubiquitous for communication protocols and apps.
The large tech companies whose business models involve privacy violations and stealing from artists and other creative workers to burn down so gloriously that society forgets the word "billionaire" in twenty years.

2026-02-20 03:46:53 UTC

I've had a few people ask why I didn't post the full Matrix email on my Fedi thread. There are two reasons:
It would fit.
Listen carefully:
Y'know how "just getting caught cheating on your monogamous partner" isn't the right time to discuss exploring ethical nonmonogamy?
In a similar vein, asking for information while dismissing a report as "no practical security impact" is still dismissing the goddamn report.
I excerpted the part of their email where they dismissed my report. That was the part that initiated the immediate disclosure. The inciting turn of phrase.
It doesn't matter how much you piss on my leg, I'm not going to believe it's raining.

2026-02-19 14:14:44 UTC

I see the Matrix leadership's propaganda is convincing the most annoying people to speak
https://bsky.app/profile/soatok.bsky.social/post/3mf7rjhuuk223
https://furry.engineer/system/media_attachments/files/116/097/701/217/320/617/original/35f91d777652e781.jpg

2026-02-19 05:21:18 UTC

Stolen from a hellsite user
https://furry.engineer/system/media_attachments/files/116/095/612/433/571/649/original/685d06e64a9339fe.png

2026-02-19 05:00:46 UTC

- reply

@nprofile…4pdu lol oops

2026-02-19 04:45:36 UTC

- reply

Is there some paychological element I'm missing here?
"I survived the hazing ritual of unreliable software, now it's essential to my identity"?
Like, do we need to consider cult deprogramming tactics to reintegrate them into society or something?
I do not understand their brainworms.

2026-02-19 04:43:37 UTC

I've never met a bigger group of dumbfucks than Matrix defenders
Like holy shit, how are they all so dense

2026-02-18 02:47:38 UTC

- reply

There's a lobsters user who's aghast at me for sticking to my guns.
https://lobste.rs/s/oukhsl/cryptographic_issues_matrix_s_rust#c_ahlbc9
lol, ok

2026-02-18 02:46:46 UTC

I'm going to be very clear about something:
If you tell me that something I reported has "no security impact", I publish it as soon as possible.
If you're wrong in your assessment of the actual security impact, that's not my problem.
If you're citing an argument about the wrong level of abstraction, I will tell you you're wrong (and why) while I'm publishing.
Do you know a neat trick for avoiding this outcome?
It's called the Socratic method in fancy circles, but it's basically: Ask clarifying questions.

2026-02-18 01:02:15 UTC

- reply

Echoed for emphasis:
We've previously considered adding it but ultimately avoided it due to the conclusion that there's no practical security impact on Matrix.
Once again, they are insisting "We already knew about this risk but decided it's okay to not fix it or tell anyone about it".
Which is FUCKING BONKERS for a so-called secure messaging product!

2026-02-18 01:00:19 UTC

- reply

I want to include this excerpt from the Matrix response:
Your PoC correctly demonstrates that the Olm 3DH implementation in vodozemac does not currently perform the all-zero DH output check. As
we're sure you're aware, the check for contributory behaviour in X25519 is a contentious topic among cryptographers, with some calling for it, but others like RFC 7748[1] calling it optional or even arguing against it (e.g. Trevor Perrin[2]). We've previously considered adding it but ultimately avoided it due to the conclusion that there's no practical security impact on Matrix. In other places like SAS/ECIES we explicitly reject non-contributory outputs because those handshakes can be used in unauthenticated contexts where an all-zero DH output could directly collapse channel security.
The [2] points to https://moderncrypto.org/mail-archive/curves/2017/000896.html
Which is talking about the Diffie-Hellman primitive, not what protocols building atop ECDH should do.

2026-02-17 23:47:39 UTC

https://soatok.blog/2026/02/17/cryptographic-issues-in-matrixs-rust-library-vodozemac/
#Matrix #infosec #vulnerabiltiy #cryptography #privacy

2026-02-17 23:43:06 UTC

Matrix responded to my email. They insist:
there's no practical security impact on Matrix
So I'm publishing in a moment.

2026-02-17 06:07:33 UTC

By the way, if you're looking at Stoat:
https://github.com/stoatchat/for-ios/blob/608aaef919bc3c6de42f89169b76b213efacfd94/Revolt/Info.plist#L19-L22
Take a guess what this does.

2026-02-11 19:30:29 UTC

- reply

@nprofile…fwgd That said, secure encryption needs to be lower-friction for most people to use.
It needs to be secure even if the end user isn't thinking about security.
This is why I've spent years on Key Transparency, where most app developers were perfectly content with "demand users manually verify key fingerprints" instead.

2026-02-11 19:25:54 UTC

- reply

@nprofile…fwgd Anyway, to that I say: No.
It's important for privacy that a lot of the data being encrypted is low-value.
If you only ever encrypt activist stuff, then by virtue of using encryption the government can argue they know you're doing activist stuff. Possibly illegal activist stuff. And a Grand Jury will be convinced.
But if we normalize using encryption always, not just for "sensitive" stuff, then that argument falls apart.

2026-02-11 19:24:33 UTC

@nprofile…fwgd Your post keeps 404ing every time I try to interact with it.

2026-02-11 18:01:54 UTC

On Discord Alternatives
Next month, Discord is going to start requiring age verification. The backlash from gamers everywhere has been predictable and justified. I guess their company name checks out. I've had a few people reach out to me because of my prior vulnerability disclosures and criticism of encrypted messaging apps. (Thanks, Toggart.) Unfortunately, asking a cryptography-focused security engineer for app recommendations is like asking a rocket scientist to…
http://soatok.blog/2026/02/11/on-discord-alternatives/

2026-02-08 02:51:44 UTC

If you're not on PrEP, I highly recommend checking out one of the services that makes it easy to access, often at no or very little cost.
I use MISTR.

2026-01-26 01:17:20 UTC

- reply

I wanted to put "kill PGP" on the list, but that's a multi-year effort.

2026-01-26 01:15:05 UTC

Now that January is almost over, my plans for the year are as follows:
Increase gay furry levels beyond what the word "cringe" can bear
Ship key transparency for Fedi (to make E2EE practical)
Make threshold code signing a real thing open source teams can consider
Ship a demo of Copper & Ember
More collaboration on security and privacy projects for 2027

2026-01-19 13:50:39 UTC

I had a cursed dream that people were hitting me up on Grindr to ask about the security of various messaging apps that claim better security than Signal and now my day is ruined

2026-01-19 02:04:47 UTC

- reply

@nprofile…9ctw Um, no. That's literally not possible in this design lol

2026-01-18 23:53:50 UTC

Just tagged v0.2.0 of the pkd-server-php software:
https://github.com/fedi-e2ee/pkd-server-php/releases/tag/v0.2.0

2026-01-18 00:40:48 UTC

If anyone ever gets hired at Valve, please increase the number of tags we can add to our Ignore list.
We should be able to ignore at least log(N) tags (where N is the number of distinct tags that users and/or publishers can add to a game), not just 10.

2026-01-15 14:51:21 UTC

- reply

@nprofile…2m30 Thanks, I'm glad you found it useful!
I don't anticipate it will be one of my more popular posts, so I'm glad to hear you found it so :3

2026-01-14 23:53:56 UTC

This is a must-read.
https://cryptography.io/en/latest/statements/state-of-openssl/
#python #cryptography #crypto #openssl #opensource

2026-01-14 23:25:46 UTC

Trying to git push on a fucking hotspot and getting timeouts is really frustrating

2026-01-13 18:46:40 UTC

Do not go to the Orange Site thread about Scott Adams dying.
I have a really bad headache now.

2026-01-13 15:37:42 UTC

- reply

Private equity ghoul:
"Hi yes I would like to own you."
Me:
"Sorry I don't do power exchange erotic roleplay with strangers."

2026-01-13 15:35:33 UTC

Doing it wrong:
"I would like to make money selling a subscription service that lets you chat privately."
"Oops, capitalism."
Doing it right:
"I'm building this shit as my fursona and releasing everything under CC0 so there's no point in capital to every try to seek ownership."

2026-01-12 23:40:20 UTC

Sorry if you followed me because you were hoping for messenger app drama
It's fursuit boosts and nerding out about software assurance in between illegal puns

2026-01-09 15:30:50 UTC

- reply

@nprofile…h7sh https://xkcd.com/1168/

2026-01-09 15:27:39 UTC

- reply

What does "less-technical" mean here?
If you recognize the term "kASLR" or "Frobenius trace" or can type a valid flag for the tar command from memory, you're probably technical.

2026-01-09 15:11:35 UTC

I'd like to ask some of the less-technical folks that follow me to read this and tell me if it makes sense to you?
https://github.com/fedi-e2ee/public-key-directory-specification
(I'm trying to make it less intimidating to newcomers)

2026-01-08 15:36:49 UTC

Do you have an opinion on Delta Chat?
https://soatok.blog/encrypted-messaging-apps/
Do you have an opinion on SimpleX?
https://soatok.blog/encrypted-messaging-apps/
Do you have an opinion on Olvid?
https://soatok.blog/encrypted-messaging-apps/
Do you--
Please stop.

2026-01-05 15:46:54 UTC

Please do not confuse Fedi shitposts for advice, guidance, wisdom, or spiritual enlightenment

2025-12-31 09:36:34 UTC

- reply

@nprofile…hh3g Maybe read the website where each vulnerability actually explains the disclosure timeline and stop asking questions that have already been answered?

2025-12-31 08:23:39 UTC

- reply

@nprofile…hh3g @nprofile…lara I disagree. Let's leave it at that for today.

2025-12-30 19:37:44 UTC

- reply

@nprofile…yuel @nprofile…hh3g You cannot fix emails. I'm sorry, but that's just not going to happen.
You either replace email or you give up entirely. There's too much political power in the hands of people that do not want anything solved.
PGP is downstream of that mess. People have tried for years to fix PGP. That's what Sequoia allegedly was going to be.
That still hasn't happened, because PGP implementations refuse to say "we only support the newest stuff, and only the features and use cases that need to exist".
Why was the \f flag even in GnuPG? That shouldn't be a feature. If you designed a CTF challenge with that feature the judges would tell you it's too obvious and stupid, and to go back to the drawing board.

2025-12-30 19:34:37 UTC

- reply

@nprofile…yuel @nprofile…hh3g Nope.

2025-12-30 13:56:44 UTC

- reply

@nprofile…hh3g https://words.filippo.io/keyserver-tlog/

2025-12-30 13:54:40 UTC

- reply

@nprofile…hh3g
I would focus on improving what we have by evolution, not revolution.
There's little to improve on for Age, Minisign, etc.
I'm not here to improve PGP. I'm here to kill PGP.

2025-12-30 13:53:37 UTC

- reply

@nprofile…hh3g The PHP is unimportant.
Once the reference software is stable, I will revive the Go implementation.

2025-12-30 13:46:57 UTC

- reply

@nprofile…hh3g
wouldn't it be enough to propose RFC for secure email handling by email clients?
No. The problems with encrypted email are unsolvable by RFCs.
Creating completely new protocol might hit problems solved already in existing protocols.
This is why https://github.com/soatok/awoo-specification is still an empty repo: It's work I planned to do after I solved key transparency for Fedi and E2EE happens.
For example user friendly, decentralized key distribution has no great solution, if it should be secure at the same time?
Literally, https://soatok.blog/2025/12/15/announcing-key-transparency-fediverse/

2025-12-30 13:39:58 UTC

- reply

@nprofile…hh3g We replace email itself with a protocol that doesn't have a plaintext fallback mode, but has the same UX and can optionally yeet ciphertext (without meaningful metadata) over IMAP/SMTP if necessary.

2025-12-30 13:27:42 UTC

- reply

I think 2026 should be the year that we make PGP irrelevant.
Not just GnuPG (Koch's implementation), but the entire OpenPGP ecosystem.
Most cryptographers I talk to gave up on PGP over a decade ago.
(After seeing the arrogance and dismissiveness that bled through Koch's oss-security email, who can blame them?)
If you're a country whose government mandates the use of PGP, even in obscure places, let's talk about how to replace PGP.

2025-12-30 13:17:06 UTC

We should talk about Werner Koch's response https://gpg.fail on the oss-security mailing list.
https://www.openwall.com/lists/oss-security/2025/12/29/9
Yes, and actually the only serious bug from their list.
Koch either didn't watch the talk, he is in such defense of his own ego that he can't see how serious the bugs were, or he's tacitly admitting that PGP is not a serious recommendation.
Can you distinguish between these three explanations?
Could it be all of them are true?
Impact
While this may allow remote code execution (RCE), it definitively causes memory corruption.
Good research.
I think this sarcastic quip is what reveals Werner Koch's opinion about the security researchers and their work.
The rest of his email is measured (and partly responding to other mailing list participants rather than the disclosure directly).

2025-12-24 00:50:06 UTC

- reply

Is this possible? I dunno. I'm not specialized in this.
But if I wanted to fuck the GenAI bubble over and had the relevant background experience? This is what I'd explore.

2025-12-24 00:47:59 UTC

Honeatly, the thing that will probably kill LLMs the hardest is someone writing a small language model that fits in JavaScript in a browser and hits comparable benchmarks.
Why bother with all those GPUs and energy usage if your Raspberri Pi could get comparable results?

2025-12-08 18:32:49 UTC

- reply

Like, I'm not even mad. This is such interesting fan faction that I have to applaud it.
Furry wife? My dude, I'm gay and not cool enough to find a boyfriend in the furry community. You're hallucinating more than the latest ChatGPT model here.

2025-12-08 18:31:32 UTC

Every once in a while, I come across haters who have such incoherent reasons to hate me that I feel like some genuine creativity is being squandered.
Thread: https://lemmy.ml/post/38394952
Archives:
https://web.archive.org/web/20251208182953/https://lemmy.ml/post/38394952
https://ghostarchive.org/archive/ses6r
https://archive.is/P9CdF
And I'm just sitting here wondering, "Give me things that never happened for $300, Alex."
https://furry.engineer/system/media_attachments/files/115/685/363/771/342/370/original/6107c07e37254a96.png

2025-12-03 22:33:56 UTC

- reply

@nprofile…tz5m Yeah but then you shove it all into one layer instead of having multiple.

2025-12-03 21:41:34 UTC

- reply

Anyway, WebAuthn uses cryptography in a really cool way.
The server just stores a public key and a credential identifier (basically UUID).
Auth requests and responses are bound to the domain, and cannot be reused across domains.
This means even if you pop the server, you don't gain any useful credentials for other servers (that you haven't already compromised).
You cannot phish it. You cannot credential stuff it.
It's not a silver bullet against all possible threat models, but it's way better than passwords.

2025-12-03 21:27:17 UTC

- reply

The thread that went off the rails, if you're wondering why I'm stating the obvious:
https://furry.engineer/@soatok/115655059604293488

2025-12-03 21:25:24 UTC

- reply

The point of TLS isn't to prove trust in a social sense.
(Otherwise, Palantir and Celebrite wouldn't be allowed to use TLS.)
It's more of a, "Your browser knows the public key it's seeing is 'correct' for this hostname" notion of trust.
Confusing social matters (this is not crimes) with technological ones (certificate is valid, signed by a CA, and issued for the same origin) is a mistake.

2025-12-03 21:20:32 UTC

- reply

So, like...
Domain validation for Lets Encrypt is fine, actually. As long as Certificate Transparency is working, and security nerds are actually auditing the transparency logs for anomalies or misissuances, it's worlds above what we had even last decade. We do not talk about OCSP or how broken revocation is in practice. Short-lived certs ftw.
Whenever someone bitched about LetsEncrypt or CloudFlare signing TLS for cybercriminals, they're fundamentally misunderstanding WebPKI.
Whenever they insist on OV/EV certificates, they show that their opinions are worth less than used toilet paper.

2025-12-03 21:16:07 UTC

Is it safe to talk about network security? Or will I summon another crank into my mentions?

2025-12-02 18:23:17 UTC

I'm not looking forward to 2026, to be honest. Not that 2025 is very good either.
I just don't expect things to improve until, maybe, 2027 at the earliest.

2025-12-01 17:48:19 UTC

Between that jerk-off on the elliptic issue baselessly accusing me of conspiring to commit computer crimes to that bluesky rando imolying that my blog is "entirely AI generated", I'm noticing an annoying pattern.

2025-12-01 10:03:45 UTC

I don't know what inspires strangers to insult me like this, but it's tiresome as fuck.
https://web.archive.org/web/20251201100137/https://bsky.app/profile/hexmani.ac/post/3m6vluxqecs22
https://furry.engineer/system/media_attachments/files/115/643/733/167/312/843/original/b4b2059134c1ce38.png

2025-11-27 19:27:48 UTC

I do not need more notifications kthx

2025-11-27 04:00:02 UTC

Every time I typo "github" as "guthub" I imagine a crossover of vore furries and FOSS devs

2025-11-26 22:59:08 UTC

I saw someone a while ago quip something to the tune of "furries only have one joke, and it's their sex life".
And, yeah, but there's a very good reason why that is.
Most people when they join the fandom from a less accepting environment. There's a lot of internalized shame, especially if you were in the closet about your gender or sexual orientation. One way that people cope with adjustments is through humor.
Furry sex jokes are often thinly veiled self-deprecation.
"Haha, look how down bad I am." -> decoder ring -> "I could have never even joked about being a thirsty slut before I found this space, and I'm still not fully comfortable with that."
Not always. But sometines.

2025-11-25 17:19:34 UTC

- reply

@nprofile…4udc Correct.