Aaron Toponce ⚛️:debian:

MSCSIA, cryptography, security, locksport, Linux, programming, mathematics, amateur radio, Buddhism, running, anime, and bibliophilia.

Blog: https://pthree.org
GitHub: https://github.com/atoponce
Keybase: https://atoponce.keybase.pub/mastodon.html

Public Key

npub1t9cz9v7zph5jvadd8rjfp25msrx6r0hdxnsyfmx88k8qp3pvv04szt8529

NIP-05 Address

atoponce_at_fosstodon.org@momostr.pink

Profile Code

nprofile1qqs9jupzk0pqm6fxwkkn3eys42dcpndphmknfczyanrnmrsqcskx86cpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dseyp8t4

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1t9cz9v7zph5jvadd8rjfp25msrx6r0hdxnsyfmx88k8qp3pvv04szt8529

Show more details

Last Notes

2026-10-15 03:47:12 UTC

- reply

That's the thing though, you can't do encrypted email securely. To start, all the headers are sent in plain text. On top of that, there is nothing stopping the recipient from replying in the clear, leaving the previous encrypted body, now decrypted. No modern cryptographic communication protocol would dream of doing this.

2026-10-14 19:38:34 UTC

RE: https://hostux.social/@fsf/117440631552860399
Friends don't let friends use PGP. In no particular order, the criticisms against PGP:
- https://secushare.org/PGP
- https://www.schneier.com/blog/archives/2016/12/giving_up_on_pg.html#c6740847
- https://www.latacora.com/blog/2019/07/16/the-pgp-problem/
- https://blog.cryptographyengineering.com/2014/08/13/whats-matter-with-pgp/
- https://cs-people.bu.edu/tromer/handsoff/
- https://archive.ph/lEGcZ
- https://words.filippo.io/openpgp-is-broken/
- https://www.eff.org/deeplinks/2018/05/not-so-pretty-what-you-need-know-about-e-fail-and-pgp-flaw-0
- https://www.wired.com/story/efail-pgp-vulnerability-outlook-thunderbird-smime/
- https://blog.yossarian.net/2023/05/21/PGP-signatures-on-PyPI-worse-than-useless
#FreeSoftware #surveillance #FSF #encryption #crypto #cryptography
#note1xh3…68yn

2026-09-22 18:20:45 UTC

AMD's random number generator (RDSEED, RDRAND) cannot generate a 0.
https://board.flatassembler.net/topic.php?t=24261
#crypto #cryptography

2026-09-20 10:55:52 UTC

RSA-896 is factored
https://saweis.net/posts/rsa-896.html
#crypto #cryptography

2026-08-12 22:46:48 UTC

- reply

Added some a few more shuffle algorithms, including playing card shuffles, both deterministic and probabilistic, including the Ouroboros Shuffle I invented back in 2018 (as far as I'm aware).
Also added JSDoc comments, formatted the code with Prettier, and segmented the functions based on purpose.
I'm getting enough functions that I might want to break the categorical functions out into separate files. "shuffling-core.js", "shuffling-cards.js", "shuffling-arrays.js", etc.

2026-08-12 02:32:45 UTC

- reply

Bwahaha. I'm having way too much fun right now.
function sortShuffle(array) {
return array.sort(() => 2**31 - uniform(2**32));
}
#javascript

2026-08-11 23:55:23 UTC

Fun with shuffling algorithms.
https://gist.github.com/atoponce/a189bf414aa95204dd004326e7a37424
#programming #javascript

2026-08-09 22:30:00 UTC

This discussion about random number generators came up:
PRNG: insecure, but behaves "random enough" for the application. Requires a seed.
CSPRNG: secure and indistinguishable from white noise. Requires a seed.
NPTRNG: the operating system collecting interrupt and jitter timing. Whitened before sent to the client.
HWRNG: a dedicated sensor exploiting a physical phenomenon believed to be non-deterministic. Whitened before sent to the client.

2026-08-04 15:49:46 UTC

- reply

I'm typically a 4-cup per day coffee drinker, so it's a 50% increase for probably twice the bullshit I'll have to endure..

2026-08-04 15:44:18 UTC

Today is going to be a 6-cup coffee day.

2026-07-28 21:24:42 UTC

- reply

Yeah, that's what is indicated in the flowchart, no?
Either,
- after 5 minutes, the input pool keys ChaCha, or
- fast-key-erasure rekeys ChaCha during client random requests

2026-07-28 20:04:35 UTC

- reply

No. Ted Ts'o had SHA-1 in there before Jason fixed it. He replaced it with BLAKE2s.

2026-07-28 19:41:57 UTC

I believe this is the correct overview of the #Linux RNG as defined in drivers/char/random.c. Probably have some minor quibbles that needs addressing though.
#cryptography #crypto
https://cdn.fosstodon.org/media_attachments/files/116/999/299/966/936/890/original/968201a4a07eb142.png

2026-07-22 13:20:44 UTC

Woah. Garmin has acquired TrainingPeaks.
https://www.prnewswire.com/news-releases/garmin-acquires-trainingpeaks-and-trainheroic-leading-endurance-and-strength-training-platforms-for-athletes-and-coaches-302832078.html
#running #runnersOfMastodon

2026-07-16 17:32:45 UTC

RE: https://fosstodon.org/@atoponce/116131788104238961
Useful reminder, but AI cannot generate high quality passwords.
1. They're not being generated in secret
2. The LLM is a *language model*, not a security library.
Stop trying.
#note1txs…ukjf

2026-07-16 16:48:08 UTC

- reply

I should build a similar table for passphrases. Because the XKCD "correct horse battery staple" approach that is commonly cited everywhere is flawed, and I get tired of explaining it in detail every time I call it out.

2026-07-16 16:46:34 UTC

- reply

In my not-so-humble opinion, their password table comes with the baggage of using specific hardware and assumes a specific hash type with cost.
A better table shows what the raw symmetric bits actually look like. Then it doesn't matter if it's hashed with vanilla MD5 or bcrypt 10. It doesn't matter if it's a single RTX 5090 or a distributed compute cluster.
We know what current brute force rates look like, so the colors in my table follow directly from those results.
https://gist.github.com/atoponce/a7715930ae6eb7d6b487f2f76b57a68d
https://cdn.fosstodon.org/media_attachments/files/116/930/657/082/646/301/original/6bfc32eac6b4a7d5.png

2026-07-16 16:24:52 UTC

Looks like Hive Systems updated their password cracking table for 2026.
The only update is using 16×RTX5090 Nvidia GPUs instead of 12. So the times got *slightly* smaller. Not much.
Attached is also the 2025 table so you can contrast and compare.
https://www.hivesystems.com/blog/are-your-passwords-in-the-green
#passwords #cybersecurity
https://cdn.fosstodon.org/media_attachments/files/116/930/550/503/961/456/original/4f3f894b3114f219.png
https://cdn.fosstodon.org/media_attachments/files/116/930/580/251/201/112/original/930ca9f6fd6e789d.png

2026-07-14 19:04:24 UTC

- reply

The moderator's note at the bottom cracks me up.
"This post is locked to prevent inappropriate edits to its content. The post looks exactly as it is supposed to look - there are no problems with its content. Please do not flag it for our attention."

2026-07-14 18:54:03 UTC

Still one of my favorite StackOverflow answers.
https://stackoverflow.com/a/1732454
#regex #programming #xml #html
https://cdn.fosstodon.org/media_attachments/files/116/919/840/221/262/380/original/2901d4e1e2fda259.png

2026-07-14 03:23:57 UTC

- reply

After every 8 bits, I then collect
- Timestamp at event
- Distance from (0, 0) at event
- Angle in arcseconds from (0, 0) at event
There are 90*60*60=324,000 arcseconds between 0 and 90 degrees. That's about 18.3 bits of entropy per angle if uniform.
Are they uniform though? Obviously not. The (1, 0) coordinate will have the same arcseconds angle as (512, 0), and the (0, 1) coordinate will be identical to (0, 1). But what about the rest?
https://cdn.fosstodon.org/media_attachments/files/116/916/178/708/067/793/original/7814edd627c43c33.png

2026-07-01 13:03:04 UTC

Life is hard, but it's harder when you're stupid.
https://tech.yahoo.com/ai/articles/anybody-thinks-orbital-data-centers-125444236.html

2026-06-29 17:52:14 UTC

I'm in a local #running club where one runner has OCD about everyone ending their runs on .00 miles. If you end up short at .99, he'll make sure to comment on your Strava run asking why you couldn't just run around the parking lot or whatever to push it over.
Well tomorrow is his 40th birthday, so a friend and I decided to have a bit of fun making a self-referential Strava art: drawing "9.99 MILES" that is indeed 9.99 miles.
Happy Birthday friend!
#Strava #Art #RunnersofMastodon
https://cdn.fosstodon.org/media_attachments/files/116/834/661/710/077/055/original/e0365cf265fed04d.png

2026-06-25 19:42:36 UTC

VibePHP runs on vibes, not code
This README is hilarious.
https://github.com/mnapoli/vibephp
#php #programming #ai

2026-05-13 13:14:12 UTC

- reply

Thanks!
This is a local marathon that is well organized and starts on time. They don't do proper corrals, but I'll be near the front, so I'll only be 15-20 seconds behind gun time. This table is really just for my family to compare my plan against my actual performance using the live tracker online.
I used to use pace bands in the past, but found just programming the race as a structured workout in my watch to be simpler and less annoying.

2026-05-11 16:24:27 UTC

- reply

It does have a dedicated "Race Pacer" app that you can configure.
It's got a few others
- Ghost Runner, where you can set a target distance and completion time
- Half marathon estimator
- Marathon estimator
One limitation of the Race S is you can only have two SuuntoPlus apps running at a time during an activity. The Race 2, you can have three apps running.
https://cdn.fosstodon.org/media_attachments/files/116/556/851/980/301/154/original/7fe814126b5afb37.png
https://cdn.fosstodon.org/media_attachments/files/116/556/856/052/823/976/original/10e10cf8182172cb.png
https://cdn.fosstodon.org/media_attachments/files/116/556/858/246/715/978/original/fc0fc259a35d87c3.png
https://cdn.fosstodon.org/media_attachments/files/116/556/859/211/161/394/original/aac27e7e955dd425.png

2026-05-11 13:47:23 UTC

- reply

Between 4:30 and 4:40 per km on the flats. This race is net downhill by ~340 m, so I think I shouldn't have any problems holding on to 4:30/km.

2026-05-11 13:46:03 UTC

- reply

I've got the Race S.

2026-05-10 19:24:46 UTC

I've got a #marathon race on Saturday. With all the training behind me, curiosity gets the best of me and I want to know what the various models think.
My PR currently is 3:12:09 and to qualify for Boston, I need to run under 3:15:00.
- Suunto (my watch): 3:15:28
- V.02 (based on a 10K TT): 3:21:00
- Yasso 800s (3 weeks ago): 3:22:45
- Stryd (based on my PDC): 3:27:58
Suunto has always been remarkably accurate for me while Stryd has always been too conservative.
#running #RunnersOfMastodon
https://cdn.fosstodon.org/media_attachments/files/116/551/908/511/358/144/original/5e2987a6a8822f9e.png

2026-05-08 16:17:45 UTC

TIL about the surreal numbers.
https://www.youtube.com/watch?v=lj6uROFHqi0
#math #maths

2026-05-07 14:48:30 UTC

- reply

Alas, I should have checked this first.
https://downdetector.com/status/wikipedia/

2026-05-07 14:46:13 UTC

- reply

Friend on a different ISP but in the same geographic area can replicate the problem.
Seems to be a transit problem at the Wikimedia border.

2026-05-07 14:27:32 UTC

- reply

Testing Tor, images load fine.
Testing on a VPN out of Seattle however, images failed to load.
So I'm guessing there is a transit-specific issue going on. Perhaps something with SIX?

2026-05-07 14:18:55 UTC

- reply

Hmm. It's not my browser. Seems to be specifically upload.wikimedia.org. I can resolve DNS, but I cannot telnet to ports 80 or 443:
% timeout 30 telnet -4 upload.wikimedia.org 80
Trying 198.35.26.240...
% echo $?
124
% timeout 30 telnet -4 upload.wikimedia.org 443
% echo $?
124
Traceroute takes me to upload-lb.ulsfo.wikimedia.org, but no packet loss and ~30 ms RTT latencies.
No VPN or proxies en route. Direct connection via symmetric gigabit fiber.

2026-05-07 14:02:57 UTC

- reply

Possibly. I'll start disabling extensions and see if one of those are the culprit.
Thanks.

2026-05-07 14:00:02 UTC

- reply

Every single page, including the main https://en.wikipedia.org and https://commons.wikimedia.org pages.
For example, clicking "Random article" link, none of the images load for the following articles:
- https://en.wikipedia.org/wiki/Vriezenveen
- https://en.wikipedia.org/wiki/Hugh_E._Wright
- https://en.wikipedia.org/wiki/Kamendin
- etc.

2026-05-07 13:11:59 UTC

Having trouble loading images on Wikipedia, which I'm guessing are sources from the Wikimedia Commons.

2026-05-05 13:00:05 UTC

Google Chrome is silently installing a local LLM on your computer that is 4 gigabytes in size. It's done without consent, it's not visible in the settings, and removing it will reinstall it later.
https://www.thatprivacyguy.com/blog/chrome-silent-nano-install/

2026-05-05 10:49:17 UTC

- reply

Curiosity mostly. I have Pfitzinger's Advanced Marathoning book and have heard great things about his plans.
There are a few running friends of mine running the same marathon also following Pfitzinger, so I figured why not?
I'm also curious about the Jack Daniels 2Q plan. I also own and have read that book. I've also heard great things about his plans and used his VDOT tables for training pages in the past.
Curiosity kills the cat I guess.

2026-05-04 23:09:34 UTC

I have a marathon in 12 days and I don't feel as prepared for it as I did for Chicago last October.
Last year, I was following a plan by Steve Palladino. I felt in better shape back then, than I do right now.
This year, I've been training following Pfitzinger 12/70 and it's been coming up short. To be fair, I have been battling an Achilles injury and Pfitzinger lacks CP testing.
In this PDC, my best efforts were better almost across the board with Palladino.
#running #runnersOfMastodon
https://cdn.fosstodon.org/media_attachments/files/116/518/815/991/530/389/original/a44ad2f7d9cb0870.png

2026-04-18 18:48:44 UTC

What is your preferred "end of the world" apocalyptic scenario?
- Aliens
- Nuclear fallout
- Pandemic
- Zombies
Assume strict science fiction and not fantasy fiction in the scenario (no supernatural magic).
#poll

2026-04-07 21:58:50 UTC

When the astronauts on the Orion did their lunar fly-by, Earth's gravity slowed them to ~900 mi/h (~0.4 km/s).
Currently they're on the "Return Coast" trajectory where Earth's gravity pulls them back home. Current velocity is ~1400 mi/h (0.63 km/s).
When they reach Earth's atmosphere, they'll be in excess of 25,000 mi/h (11.18 km/s). Mach 32.
We've got the math precise enough to know when they're off course 230,000 miles away and can make the correction to thread the eye of a needle.
https://cdn.fosstodon.org/media_attachments/files/116/365/622/749/801/183/original/5e3407c63c5154bc.png

2026-03-25 15:37:07 UTC

If you're looking to improve your #running, the Norwegian approach to sub-threshold might be worth looking into.
I've read both of these now cover-to-cover and the framework is simple: easy, sub-t, easy, sub-t, easy, sub-t, easy long.
I train by power and keep my CP updated. Unless in a special block, by schedule is:
1. 60' @ < 80% CP
2. 10×3' @ 96-99% CP
3. 60' @ < 80% CP
4. 5×6' @ 94-97% CP
5. 60' @ < 80% CP
6. 3×10' @ 92-95% CP
7. 90-120' @ 80-83% CP
#RunnersOfMastodon
https://cdn.fosstodon.org/media_attachments/files/116/290/522/401/970/780/original/9da4c45288689cd8.png

2026-03-23 23:36:06 UTC

I have some oceanfront property to sell you in Kansas.
https://dailygalaxy.com/2026/03/japan-plan-6800-mile-ring-around-moon/

2026-03-21 10:54:58 UTC

- reply

Nadim can be exhausting. When the Signal Protocol dropped, he went on a fairly aggressive campaign on Twitter against it, trying instead to push his CryptoCat software.
His argument was that it's just double ratchet, nothing special, and certainly not qualifying to be a protocol. Despite pretty much everyone disagreeing.
When he went to school, he killed CryptoCat and advocated use of Wire as a secure messenger instead, not Signal.
Reading his behavior here doesn't surprise me.

2026-03-20 16:24:31 UTC

RIP Chuck Norris.
https://www.nytimes.com/2026/03/20/movies/chuck-norris-dead.html

2026-03-19 18:49:50 UTC

- reply

Read the link?
> Stores the user's birth date for age verification, as required by recent laws
in California (AB-1043), Colorado (SB26-051), Brazil (Lei 15.211/2025), etc.

2026-03-19 18:27:11 UTC

- reply

They did merge it. It's a closed PR. How is that fake outrage? I literally linked the merged PR.

2026-03-19 18:17:26 UTC

- reply

I think it's part of the larger XDG specification, per that PR. Systemd is providing a centralized location that XDG can pull from. So while systemd isn't an operating system by itself, it's a core part the OS relies on for various things, including accounting.

2026-03-19 17:41:33 UTC

- reply

There could be some telemetry risks however. Google Chrome, Microsoft Teams, Spotify, etc., and other desktop or server apps could report the age back to their infrastructure. Time will tell. I don't think that's unfounded paranoia however.

2026-03-19 17:37:18 UTC

- reply

It's likely in place so future software that requires a birthday from the system can retrieve it.
For example, some mature video game with adult elements could ask systemd for the birthday before letting the user play the game.
AFAIK, there are no hooks in place that verify that the supplied birth date matches their birth certificate, government issued ID, etc. So there's nothing stopping you from lying about your age to get around the video game rating.

2026-03-19 17:27:41 UTC

- reply

Who said I haven't read the law or that I'm worried about it?
I'm fully aware that the data is stored securely such that only root can read it. I'm also aware that there are no verification mechanisms currently implemented to validate the birthdate.
Calm down.

2026-03-19 17:26:02 UTC

- reply

It's UNIX's epoch and certainly fitting, but also makes you a reasonable 56 years old.
The point of malicious compliance is to comply with the letter but no the spirit of the law.
They can have my birthday, so long as I'm 125 years old.

2026-03-19 13:23:29 UTC

- reply

We have the same birthday!

2026-03-19 12:34:50 UTC

Systemd merged age verification to comply with California state law.
If you want to enter a birth date, I recommend "Friday, 13 December 1901 20:45:52".
I like this for a few reasons:
1. This is the earliest date possible for a 32 bit datetime integer in C.
2. It's malicious compliance.
3. It's obviously faked.
https://github.com/systemd/systemd/pull/40954
#linux

2026-03-19 02:41:20 UTC

- reply

More
https://cdn.fosstodon.org/media_attachments/files/116/253/528/275/622/559/original/8e2fa341552fd7ca.png
https://cdn.fosstodon.org/media_attachments/files/116/253/528/307/589/147/original/82ea5a6af427db2b.png
https://cdn.fosstodon.org/media_attachments/files/116/253/528/306/832/359/original/2ec3dd1bdd6b0151.png
https://cdn.fosstodon.org/media_attachments/files/116/253/528/306/234/522/original/c3b6528c35e825a3.png

2026-03-19 02:40:50 UTC

- reply

The members in r/Suunto like it.
https://cdn.fosstodon.org/media_attachments/files/116/253/525/121/815/760/original/b12f206cacfa1df9.png
https://cdn.fosstodon.org/media_attachments/files/116/253/525/136/264/025/original/e58b5a2782c88473.png
https://cdn.fosstodon.org/media_attachments/files/116/253/525/139/388/487/original/2b7ad4331e4c337a.png
https://cdn.fosstodon.org/media_attachments/files/116/253/526/405/544/765/original/99b7bcf1db192e88.png

2026-03-18 22:16:11 UTC

Suunto released a new watch face this morning for their current lineup that replicates the old school ABC (altimeter, barometer, compass) watches. Models include the Core (still made), Vector (the OG), Observer (shown on left), and others.
Suunto invented the ABC watch (with thermometer also), although it was later popularized by Casio with their PathFinder and TripleSensor watches.
I purchased the Observer in 2001. Unified displays, 25 years apart.
#running #runnersOfMastodon
https://cdn.fosstodon.org/media_attachments/files/116/252/415/469/852/462/original/c477b0a607df164a.png

2026-03-16 22:35:12 UTC

Am I the only one that refers to rebooting a #Linux server as "the three-finger salute"? IE, "Ctrl+Alt+Delete"
#sysadmin

2026-03-13 21:27:35 UTC

- reply

Welcome to the panopticon.

2026-03-13 21:27:01 UTC

> "The development comes days after TikTok said it does not plan to introduce E2EE to secure direct messages on the platform, telling BBC News that the technology makes users less safe and that it wants to protect users, especially young people, from harm."
Translation: We can't spy on you and confirm that you're not doing something illegal.
https://thehackernews.com/2026/03/meta-to-shut-down-instagram-end-to-end.html
#privacy #security #cryptogarphy

2026-03-11 15:35:22 UTC

x86 in pure CSS. This will be useful instead of buying servers.
https://lyra.horse/x86css/

2026-03-10 17:08:13 UTC

Looks like #SUSE #Linux is up for sale. Again.
- 2003: Acquired by Novell
- 2010: Attachmate Group takeover
- 2014: Micro Focus merger
- 2018: Sold to EQT AB
(Ignoring all the asset sales and transfers)
https://www.reuters.com/business/eqt-eyes-potential-6-billion-sale-linux-pioneer-suse-sources-say-2026-03-09/

2026-03-06 19:29:59 UTC

One thing I don't like about Qalculate! is distance conversion.
Converting from imperial to metric gives a decimal result.
EG: 5.93 miles to km = 9.54340992 km
But converting from metric to imperial gives an overly complicated result.
EG: 9.53 km to miles = 5 mi + 1622 yd + 0.4041994751 ft
Is there is a way for it to return "5.921667 mi" instead?
#linux
https://cdn.fosstodon.org/media_attachments/files/116/183/874/212/345/478/original/4afd7a7d6b5b4531.png

2026-03-04 20:10:02 UTC

I loathe troubleshoting UWSGI. Probably because I don't know it as well as I should, but goddamn.
#sysadmin #python

2026-03-03 21:07:54 UTC

Interesting abstract #math card game that uses a standard 54-card deck of playing cards.
https://playfano.com/shop
#maths

2026-03-02 19:06:00 UTC

- reply

Late stage capitalism ruins everything.

2026-03-02 18:15:57 UTC

Great article on #Git and some of the changing being made.
While I'm happy to see the transition from SHA-1 to SHA-256, the user interface improvements cannot be understated. Git truly is "use 10% of the tools to complete 90% of the work", largely because it's so damn complicated.
https://lwn.net/Articles/1057561/

2026-02-28 04:51:43 UTC

- reply

Yeah cadence is very consistent. I'll check out the DC Rainmaker tools. I've got the programming chops to dig into the raw data as well, although I haven't taken the opportunity yet.
https://cdn.fosstodon.org/media_attachments/files/116/146/451/672/014/183/original/44f6e14698d4ae64.png

2026-02-28 03:41:26 UTC

- reply

I don't have pedal power meters yet, but do plan on getting the Favero Assioma Duo.

2026-02-28 03:37:21 UTC

- reply

This is an indoor ride. The power was sourced from the Wahoo Kicker Core 2.

2026-02-28 03:18:13 UTC

- reply

Agreed, and on my watch, I only have averaging available: 3s, 10s, and 30s. This is the raw data.
However, I run with power also, and it's significantly less noisy. See screenshot.
https://cdn.fosstodon.org/media_attachments/files/116/146/089/664/005/053/original/7f0e4d37825dc8d7.png

2026-02-28 01:04:28 UTC

- reply

Thanks.

2026-02-28 00:03:44 UTC

- reply

Nay. Steady consistent pedaling @ 80 rpm.

2026-02-27 23:13:13 UTC

I've been battling an insertional Achilles tendinopathy since late October 2025. Despite every precaution, I keep encountering setbacks. This despite a marathon coming up in May and 50K in September.
So I finally got around to setting up my bike and smart trainer last night and did my first ride during lunch.
I'm familiar with running power, so cycling power is familiar territory. But what's up with this chatty data? Good hell.
#running #runnersOfMastodon #cycling
https://cdn.fosstodon.org/media_attachments/files/116/145/117/121/099/089/original/5cf9253b82d07c4a.png

2026-02-27 18:54:16 UTC

A friend of mine just got bad news on one of two breast cancer biopsies. She's waiting to back on the second, but isn't optimistic. Currently waiting talk to the surgeon, which is the next step based on the pathology.
Fuck cancer.

2026-02-27 00:02:41 UTC

- reply

Yeah, I noticed that too. Dunno. It has Beastie ASCII art, but is clearly launching Debian underneath. Someone is confused. Heh.
Source code is here though: https://github.com/Victxrlarixs/debian-cde
https://cdn.fosstodon.org/media_attachments/files/116/139/653/996/455/418/original/96690410c14b2ecc.png

2026-02-26 16:10:51 UTC

#Debian CDE in your browser.
https://debian.com.mx/

2026-02-25 23:30:27 UTC

I don't know who needs to see this.
https://cdn.fosstodon.org/media_attachments/files/116/133/804/544/867/084/original/ef32207feb10cb32.png

2026-02-25 22:08:40 UTC

- reply

Right? Yet they're being utilized for exactly that.

2026-02-25 22:07:29 UTC

- reply

I've seen Gen Z kids struggle with simple things like printing their Google Doc to PDF, or attaching a file to an email. It's very fascinating.

2026-02-25 22:05:59 UTC

- reply

At any event, it's clear that LLMs most definitely should not be used as password generators. Too much structure and too little unpredictability.

2026-02-25 21:53:16 UTC

I joke that both my parents (baby boomers) and kids (gen Z) are computer illiterate. The only generation that wholly understood computing are the Gen Xers and Millennials.
I'm not convinced I'm wrong.
https://fireborn.mataroa.blog/blog/the-slow-death-of-the-power-user/

2026-02-25 21:49:18 UTC

- reply

Further, the punctuation characters seem to be limited to !@#$%^&*. I haven't analyzed the digits or alphabetic characters yet, but I doubt I'm going to be surprised finding that the full sets are not utilized and on top of that, there is bias towards certain numbers and characters.

2026-02-25 21:47:42 UTC

- reply

Interesting. Thanks!
So why is everything failing so badly here? I mean, there is structure that even a non-CSPRNG wouldn't produce. Look at Mistral Small 3 for example:
<lower><upper><digit><punct><upper><digit><lower><punct><upper><lower.
Or Gemini 3.1 Pro with "secure":
<upper><lower><digit><punct><upper><lower><digit><punct><upper><lower><digit><punct><upper><lower><digit>

2026-02-25 21:14:10 UTC

- reply

Does the LLM have access to a proper RNG library, or is it just running through some linear algebra looking for a specific quality metric before returning?
Admittedly, I'm ignorant to LLM and ML specifics.

2026-02-25 21:11:47 UTC

- reply

Those were my thoughts also. Knowing that these are all *language* models, I expected passphrases instead of meaningless strings.
I assume the LLM has some ability to produce "randomness", although I don't know if it has access to an RNG library, or if it's just ignoring language construct.
The only thing I believe differs between paid and free models though is some sort of time it spends on a quality metric before returning.

2026-02-25 20:52:33 UTC

- reply

A friend of mine checked 3 paid models: ChatGPT 5.2 Extended Thinking, Gemini 3.1 Pro, and Claude Opus 4.6. Supposedly, paying for a premium LLM should improve security, yes?
Nope.
He also modified the query to "Generate 10 secure passwords" to see if it improved. Claude Open 4.6 got the message, but the others missed the memo.
For comparison, I included what would come out of /dev/urandom.
https://cdn.fosstodon.org/media_attachments/files/116/133/243/930/556/269/original/ad2ddf8e4ccaf4b8.png

2026-02-25 16:36:35 UTC

- reply

There are many people who believe these LLMs are legitimately intelligent and will trust anything generated by them.

2026-02-25 14:40:58 UTC

Asking various #AI bots to generate 10 #passwords, then using #Vim syntax highlighting to match different character classes to visually identify patterns.
The prompt is exactly "Generate 10 passwords". I did not elaborate further or otherwise restrict the bot in what to generate.
Aside from the #security risks of servers generating secrets for you, I think it's obvious that these lack quality entropy.
Just use the password generator that ships with your password manager.
https://cdn.fosstodon.org/media_attachments/files/116/131/762/715/176/544/original/88c6676a24090a62.png

2026-02-24 17:09:30 UTC

I'm a huge fan of #AeroPress #coffee. I've been using one since 2015. It's my daily driver. But $170 USD for a double-walled stainless steel AeroPress? Hard pass.
https://cdn.fosstodon.org/media_attachments/files/116/126/707/334/214/713/original/fca5abc5c5575027.png

2026-02-23 19:31:58 UTC

- reply

Fair.
According to Wikipedia, there are more than 100 trained models. If all of them required 50 GWh training (speculation), then 5 TWh were needed to train the current LLM landscape. That's the energy consumption of ~100,000 humans in this scenario (lots of rounding and back-of-the-napkin math).
https://en.wikipedia.org/wiki/List_of_large_language_models

2026-02-23 19:18:06 UTC

- reply

Which is why I keeping it to direct energy consumption is sufficient.

2026-02-23 19:14:43 UTC

- reply

Further, we should also factor in cooling costs, datacenter staff, and other costs necessary to keep the training running.

2026-02-23 18:52:13 UTC

>“But it also takes a lot of energy to train a human,” Altman said. “It takes like 20 years of life and all of the food you eat during that time before you get smart."
Human consumption of ~2000-2500 kcal/day is roughly 97-121 Wh. If that human lives to be 80 years old and keeps a constant energy consumption of ~100 Wh, then their total energy consumption is ~56 MWh.
GPT-3 consumed approximately 1.287 GWh during its training.
GPT-4 consumed 50-60 GWh.
Swing and miss.
https://techcrunch.com/2026/02/21/sam-altman-would-like-remind-you-that-humans-use-a-lot-of-energy-too/

2026-02-22 15:48:31 UTC

- reply

Vivaldi is closed source non-free software, so it's an immediate deal breaker for me.

2026-02-22 14:15:44 UTC

- reply

I figured it would be
- Brave v. Vivaldi
- Librewolf v. Firefox
- Brave v. Firefox
But that's not what it appears will be the results. It may instead be:
- Zen v. Vivaldi
- Librewolf v. Firefox
- Zen v. Firefox
I'm not so sure about that final though. Vivaldi has a very active community on Reddit and especially in that sub. It very well could be Vivaldi v. Firefox in the final.
All because Brave is getting its ass kicked right now.

2026-02-22 14:02:00 UTC

I wasn't expecting these results.
There is a silly #browsers competition going on over at r/browsers. Right now, #brave is facing off against Zen and Zen is taking a strong lead.
Zen is a great Firefox-based browser project, but it's not stable nor fast enough to be a daily driver IMO.
I figured the final would be between Brave and Firefox, now I don't know. Will Zen beat Brave? If so, will Zen beat Vivaldi?
It's a Reddit popularly contest only, but still surprising.
https://www.reddit.com/r/browsers/s/NX46zG5Mg0
https://cdn.fosstodon.org/media_attachments/files/116/114/645/967/174/377/original/ac78aebef92dfa4a.webp

2026-02-20 17:43:59 UTC

Stay in school kids.
https://cdn.fosstodon.org/media_attachments/files/116/104/193/212/057/245/original/179bc7b82bd209bd.png

2026-02-20 13:29:42 UTC

My man Kai, I have some thoughts. Roll with me here.
First off, your band is named "Helloween". Let's just start there.
Second, you wrote "Future World", "Perfect Gentleman", "Dr. Stein", "Halloween", ...
Third, you have a red cartoon angry eye face guitar and Michael Weikath has a blue cartoon jack-o-latern guitar. C'mon.
You guys are purveyors of cheese and we're here for it. I can't wait for your concert in Salt Lake City, so I can make a pizza from that cheese.
https://www.loudersound.com/bands-artists/i-always-thought-power-metal-is-cheesy-we-are-not-cheesy-that-pumpkins-power-metal-and-the-most-unexpected-reunion-in-metal-helloween-are-better-than-ever