Thomas Ptacek

It's great to see the free, cryptographically secure, and distributed keyval database that under-grids the entire internet being used to make it more secure. It's too bad lazy sys admins claim that it's not needed and spout a bunch of FUD [1] that is not true [2]. [1]: https://sockpuppet.org/blog/2015/01/15/against-dnssec/ [2]: https://easydns.com/blog/2015/08/06/for-dnssec/

Sorry, you're right, I should have been less clinical about this. Practical Cryptography (which is essentially the exact same book by the same authors) was also the first cryptography book that clicked in any meaningful way for me, and really lit me up about the prospect of finding vulnerabilities in cryptosystems. I would actively recommend against using it as a guide in 2025. But you're not crazy to have liked it before. Funny enough, 12 years ago, I wrote a blog post about this: https://sockpuppet.org/blog/2013/07/22/applied-practical-cryptography/

I wonder if starting with intentionally getting a parking fine in Chicago, followed by then submitting an FOIA about that fine and all related documents / data would have worked. Edit: seems like that was the part of the origin story of this according to https://sockpuppet.org/blog/2025/02/09/fixing-illinois-foia/

DNSSEC has aged very poorly. I also believe it operates at the wrong layer. When you surf to chase.com you want to make be sure that the website you see is actually JPMorganChase and not Mallory’s fake bank site. That’s why we have HTTPS and the WebPKI. If your local DNS server is poisoned somehow that’s obviosly not good, but it cannot easily send you to a fake version of chase.com. Part of why it’s so hard for Mallory to create a fake version of a bank site is Certificate Transparency. It makes it much much harder to issue a forged certificate that a browser such as Chrome, Safari or Firefox will accept. For further info about the flaws of DNSSEC I can recommend this article: https://sockpuppet.org/blog/2015/01/15/against-dnssec/ It’s from 2015 but I don’t think anything has really changed since that.

> Honest question, imagine if at your company tomorrow they decide to fire one principal engineer. Would you find it fair that the one is you? Would yo find it fair if you were among the 10% they fire? The 20%? The 30%? That's an interesting thought experiment. Though not as straightforward as it sounds like at first. For example, I think I'm pretty good at what I do, but I'm also pretty expensive. But more importantly, companies don't have a good handle on people's performance. They have biased estimates, at best. See https://sockpuppet.org/blog/2015/03/06/the-hiring-post/ for an exploration of this topic from a hiring point of view, but it also exists to a lesser extent when people are already working for you.

I'm pretty sure the SCT requirement contained the blast radius of this compromise to avoid anyone from actually being affected by it, so your comment doesn't really follow here. Also, DANE relies on DNSSEC [1], which is bad. https://sockpuppet.org/blog/2015/01/15/against-dnssec

Instead of doing this, read, then follow https://sockpuppet.org/blog/2015/03/06/the-hiring-post/

https://sockpuppet.org/blog/2014/02/25/safely-generate-random-numbers/ (Note, that's from 2014; today I would recommend getrandom() instead.)

Reading https://sockpuppet.org/blog/2015/03/06/the-hiring-post/#worksample, it looks like your process is better than most! However, I've walked away from interview processes that require a work sample that'll take more than a few hours or require lots of domain knowledge to get started. It just isn't worth my time, especially as a barrier to entry before talking to anyone. Things I am happy to do to see if I'm a good fit: - Pair with a developer on the team. I learn just as much about the team I'd be joining as the hiring company does about me. - Talking through code that I've written, talking through how I came to the implementation and how I might refactor/enhance further. You can't really bullshit this without the interviewer being a nit. Things I'll do as a 1099: - Fix a real bug - Refactor real code - Do a project that isn't trivial, start to finish

And definitely read the post by Thomas Ptacek linked to from that article: https://sockpuppet.org/blog/2015/01/15/against-dnssec/. He makes the excellent point that DNSSEC (and thus DANE) doesn't get rid of CAs at all - it just makes whoever controls the domain into a defacto CA. Yeah, Comodo behaved badly as a CA - so, the browsers are in the process of no longer trusting it; imagine if DANE were in widespread use and Verisign behaved badly - the browsers really couldn't do anything about it at all unless they wanted to stop supporting .com - which is impossible. "Let's get rid of CAs!" Sounds great. "Let's replace the CAs with a less accountable set of companies and governments that are harder to punish for bad behavior" doesn't sound so great. But thats what DANE is.

Or you could hire people no one else is hiring because they don't look like good candidates even though they are. You could build a system to do that. https://sockpuppet.org/blog/2015/03/06/the-hiring-post/ > Build work-sample tests. Instead of asking questions about the kind of work you do, have candidates actually do the work. Careful. I am not saying candidates should spend a 2-week trial period as a 1099 contractor. That’s a terrible plan: the best candidates won’t do it. But more importantly: it doesn’t work. Unlike a trial period, work sample tests have all three of these characteristics: they mirror as closely as possible the actual work a candidate will be called on to perform in their job, they’re standardized, so that every candidate faces the same test, they generates data and a grade, not a simple pass/fail result.

This is old, and widely recommended against (e.g. https://sockpuppet.org/blog/2013/07/22/applied-practical-cryptography/… if you trust tptacek.) It's still a good reference manual for 90's crypto, and very useful if you want to know what mistakes to expect when reviewing crypto code; but you really shouldn't read the book as a handbook unless you have enough knowledge to spot the many, many parts that will lead you astray. (tptacek's page, linked earlier, has a bit of an overview.)

Excellent article just posted in the thread about OpenBSD disk encryption that explains why existing disk encryption schemes suck: http://sockpuppet.org/blog/2014/04/30/you-dont-want-xts/ This really explains the motivations for bcachefs's encryption - in the filesystem, if we're taking encryption into account in the design, we can incorporate MACs and nonces.

rant about DANE from tptacek incoming http://sockpuppet.org/blog/2015/01/15/against-dnssec/ I don't have a strong opinion on DNSSEC myself, but I agree with him that DANE is a bad replacement for standard TLS connections. DNSSEC is by far not the best security protocol ever designed, but it can protect to some threats, like cache poisoning.

For some background: http://sockpuppet.org/blog/2015/03/06/the-hiring-post/ Part of the idea is that there are some great devs out there who don't have the resume to "just email the company and get a phone screen". I think if you look at their history with MicroCorruption (https://microcorruption.com/login) you'll see that this isn't just a recruiting tool - it's supposed to be more of an interesting programming challenge, something you'd want to spend time on whether there was a hiring company at the end or not. Long term, I hope that after StarFighter gets more history and credibility with companies, they actually will reduce or remove technical parts of the onsite interview in lieu of StockFighter results. I spent time with MicroCorruption, and I plan to spend some time on StockFighter, and I'm not looking for a job.

Have you seen their homepage? https://starfighters.io/ "Starfighter is a recruiting firm that detects and introduces the best programmers on the market." And to learn how they achieve it, see: https://starfighters.io/approach And to provide some context as to why Patrick and Thomas are in this venture, http://sockpuppet.org/blog/2015/03/06/the-hiring-post/ (my all time favorite article by Thomas) Hope this helps.

VeraCrypt or other FDE-like tools (that are meant to be used on actual drives or their imitations using a file-backed device) are not so great idea for use with Dropbox or alike file/object storages. Here's why: http://sockpuppet.org/blog/2014/04/30/you-dont-want-xts/

Obligatory reference to tptacek's post at http://sockpuppet.org/blog/2015/03/06/the-hiring-post/ -- see the end of chapter 2 for an amazing example

"More efficient" of course has many axes (cost, energy consumption, manual labor requirement vs cost of human, time, quality, etc.). However, as a long-time reverse engineer and exploit developer who has worked in the field professionally, I would say LLMs are now useful; their utility exceeds that which was previously available. That is, LLM assisted exploit discovery and especially development is faster, more efficient, and ultimately cheaper than non-LLM assisted processes. What commenters don't seem to understand is that especially CVE spam / bug bounty type vulnerability research has always been an exercise in sifting through useless findings and hallucinations, and LLMs, used well, are great at reducing this burden. Previously, a lot of "baseline" / bottom tier research consisted of "run fuzzers or pentest tools against a product; if you're a bottom feeder just stuff these vulns all into the submission box, if you're more legit, tediously try to figure out which ones are reachable." LLMs with a test harness do an _amazing_ job at reducing this tedium; in the memory safety space "read across 50 files to figure out if this UAF might be reachable" or in the web space, "follow this unsanitized string variable to see if it can be accessed by the user" are tasks that LLMs with a harness are awesome. The current models are also about 50% there at "make a chain for this CVE," depending on the shape of the CVE (they usually get close given a good test harness). It seems that…

Right, I think we're probably in agreement on a lot too. I do think if you're looking for a specific thing (whether it's a code monkey, or a visionary, or someone that seems to have the potential to grow into someone amazing, or a Postgres expert who can help you solve your particular scaling issues right now and then go away) you should try and purpose your interviews for figuring out whether those things are present to sufficient degree, and ignore/deprioritize getting data on other things. Though I also think even with the large variety of roles that exist, they all need an ability to program and solve the types of problems that the business is working on and is likely to encounter, so this should be tested/verified as early as possible, and that a lot of people are fooling themselves in thinking they need much more than that or that the other things they claim to care about actually matter. Consulting gigs (like the postgres expert) avoid a lot of the crazy interview nonsense, and a large part of that I think is that wanting to trade services for money is more than enough, but sure their limited tenure is another big factor and helps them from needing to buy into the company culture or whatever. But this precludes that the business knows what services they want to receive in exchange for money. And repeating myself, often businesses aren't even sure, or don't actually need much more beyond "can program competently for our use cases" (which doesn't mean code monkey). So…

IMHO (unfortunately) in tech the skills that allow you to succeed in a job are different than the skills that allow you to get hired for a job. This is a generalization, but I think that is what happens in most places. @patio11 has written a bit about this: https://twitter.com/patio11/status/1086379271415713792 @tqbf and Erin Patek https://sockpuppet.org/blog/2015/03/06/the-hiring-post/ I think this leads to a lot of false negatives when interviewing. but if you are applying you obviously want to increase your chances of succeeding so, you have to know how to 'play the game'. My recommendation to you would be: 1. spend a lot of time preparing for these tech interviews. Study how they are structured. There is a lot of material online (blog posts) as well as books documenting what it takes to succeed. 2. there are some people that do paid courses on "how to interview at FAANG style companies". they may be worth depending on the upside. Note that not all companies have those types of interviews but if you are aiming for them it makes sense to prepare the best you can.

> this slightly time-saving but potentially dangerous choice? The one and only danger is during the machine's boot process, because while /dev/random and /dev/urandom use the same data: * on linux /dev/random has a silly and unfounded entropy estimator and will block at arbitrary points (used to be a fad at some point, but cryptographers have sworn off it e.g. Yarrow had an entropy estimator but Fortuna dropped it) * also on linux, /dev/urandom never blocks at all, which includes a cold start, which can be problematic as that's the one point where the device might not be seeded and return extremely poor data In fact the second point is the sole difference between getrandom(2) and /dev/urandom. If you're in a steady state scenario (not at the machine boot where the cold start entropy problem exists) "just use urandom" is the recommendation of pretty much everyone: tptacek, djb, etc… https://www.2uo.de/myths-about-urandom/ https://sockpuppet.org/blog/2014/02/25/safely-generate-random-numbers/ http://blog.cr.yp.to/20140205-entropy.html (see bottom of page)

It's state of the art block level encryption, however file system level encryption such as what will be offered by the upcoming APFS is fundamentally better. In a block level encryption each sector is encrypted below the file system. Doing the naïve thing of encrypting each sector with the encryption key is fundamentally insecure. This is called the EBC mode of operation. There's a nice picture of a penguin on wikipedia encrypted with ECB which demonstrates this: https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Electroni… Secure mode of operations generally try to propagate the result of previously encrypted blocks to the next ones. But this approach is not really suitable for mass storage devices. You cannot re-encrypt all the sectors behind the one you just changed. That's just impractical, since writing to sector #0 amounts to rewrite the entire disk. So in practice schemes like AES-XTS are used. They work by having some kind of way of "tweaking" the encryption, so that it is different for each block (avoiding the pitfalls of ECB), but in a way which allows random access to sectors (i.e. in a way that is predictable). AES-XTS is a tradeoff for this special use case but it is not as robust as more classical modes of operations which would typically be used in an encrypted filesystem. Details about AES-XTS issues: https://sockpuppet.org/blog/2014/04/30/you-dont-want-xts/

How diverse would you say your friend/acquaintance group is? Are they from the same background as you? Do they have similar life stories? If not, how can you possibly imagine that you're not just soaking in confirmation bias? Don't like my opinion? How about someone else's opinion? https://sockpuppet.org/blog/2015/03/06/the-hiring-post/ There are countless examples of talented people who have been ill-served by the hiring environment and tech culture we have today. For every one of them that gets lucky and finds success through non-traditional hiring practices at a great company (for example) you have to wonder how many others (others who live where there is less opportunity, etc.) are just passed by and left behind by the system. Your attitude is very much a "let them eat cake" attitude. You look around and you say "everyone I know is successful, what are all these other people's problems?" Trust me, there are poor people out there, there are disadvantaged people out there, and partly because of unfairness built into the economy and our culture. And that extends even into the tech world. There are tons of talented people who are unemployed, underemployed, or otherwise disadvantaged simply because they don't match the traditional model of what a talented tech person looks like.

Author here: you're right, nothing revolutionary here in technique. Most/all of our actual process is ripped straight out of http://sockpuppet.org/blog/2015/03/06/the-hiring-post/. But my experience, over the course of Spreedly interacting with 100+ candidates over the past few years, is that just doing pretty standard things well, with attention to detail, is in itself revolutionary. We hear story after story from candidates about other companies they have or are interviewing at that are completely disrespectful in how they're treating candidates. Whether this is cargo culting, lack of time to do things right, or a righteous belief that it's OK to treat candidates poorly, I can't say, but it's pretty disgraceful. So, I wrote this little thing both since I needed to write it down for my coworkers anyhow - this is how we do things, showing respect for candidates by keeping reciprocity, incrementalism, and relevance in view - but also in the hopes that it's one more brick in a wall of "you're worthy of respect" for candidates. The post itself wasn't about our actual process, though I did use examples from it; I hope to write about the actual process later. But I will note that my experience of phone screens is apparently very different from yours: I've experience them as a chance to pre-grill and filter candidates, and ours is 100% not that. I ask zero questions, but instead just talk about what we do and answer any and all questions candidates have. You're right that doing…

Uh, this is also dangerous to your security. The truecrypt docs contain very large warnings about this[1]: someone who can see your disk at multiple versions may be able to drastically weaken your security. If you had keys in those truecrypt files, you should rotate them; if you had secrets, consider them compromised. Truecrypt uses XTS mode, which is Not Great -- it only exists because someone was trying to hammer ciphers into fitting nicely with fixed sized disk sectors, and it makes a number of serious compromises to do so. [2] has a good discussion of this. You do not want to combine XTS with sharing multiple versions of the ciphertext. tl;dr you've seen the penguin pictures? As [2] cleverly says, you're pretty much doing that to yourself by sharing multiple versions of the file. There's also significantly more powerful attacks that can be mounted by an adversary that can feed you corrupted blocks which will allow them to permanently compromise your key, or perform other hijinks like manipulating your content without setting off warning bells. Dropbox, or someone that compromises dropbox, is in that position, by nature of the service they're providing. These issues are rooted in the fact that XTS is not an authenticated cipher -- this leads to such an endemic category of subtle problems that it's been nicknamed "The Cryptographic Doom Principle" [3]. So yeah. If your life depends on it... don't store a truecrypt volume in dropbox. ----- [1] I found a mirror…

It's complicated. For starters, if you're looking for a _secure_ PRNG most practitioners would strongly advise _against_ the system you described[1]. There's a difference between a cryptographically secure algorithm and a secure system. For the overall system to be secure you need to make sure the seed data is secured, which you're bound to fail at unless you really know what you're doing. Providing a "cryptographically secure but not really secure" alternative implemented in user space alongside a "really secure" alternative that's been thoroughly vetted would likely just add to the confusion. If you _really_ need secure numbers you should be using the really secure one. The really secure one is almost definitely going to require a syscall worth of overhead, at least, so it's _definitely_ going to be slower than a PRNG like xorshift128+ which literally takes a single digit number of CPU cycles. Now to answer your question, if you're just talking about a CSPRNG algorithm they're probably fast enough for almost every use case. I think there's still an argument for some things like array shuffling, but those implementations could go out of their way to use the non-CS algorithm as an optimization. Unfortunately in Javascript land there's aren't many batteries included, so if you switched Math.random() to use a CSPRNG most people would end up using it for trivial stuff like shuffling arrays. If you're talking about a secure system... it's probably still fast enough for most…

It looks like there is a trend starting in the software industry to encourage empirical hiring. This particular article follows about a month after another hiring post reached the front page of HN.[1] I really agree with it, and I hope more people are looking at it seriously instead of fixating on the fact that the word "Google" is in the title. Giving all the candidates the same questions and the same exact interview methodology is much more fair and empirical than simply having an interviewer wing it (which is virtually certain to bring in bias). Most interviewers I know think they are better than the average interviewer due to illusory superiority cognitive bias [2]. However, when it comes down to it, you cannot easily judge the difference between candidates if you ask one a completely different question than another. This goes against all the principles of psychometric testing, yet it is still ubiquitous because no one has bothered to empirically look at whether or not they're really interviewing in a rigorous way. There is a serious issue in the industry right now where otherwise capable people fail interviews due to their appearance, manners of speaking or other harmless idiosyncrasies. It's because interviewers are very personally attached to their subjective methods, and they tend to really enjoy having personal ownership over the interviewing process instead of surrendering control to a standardized script. This trend looks like the software hiring equivalent of a…

I think a bunch of these tips have a bunch of 'filter out people who haven't interviewed much yet' flavor to them. Lets say someone interviews with 10 different places. The first few interviews they may make several mistakes such as be too negative about their previous work place, be too anxious, not seem enthusiastic enough in some area, not acting like this is the only place you want to work at, do not negotiate compensation in a sensitive manor or do badly in an interview question type. After these negative experiences, they will look up what they did wrong and if they did the interview again, probably do better after a few of these experiences. Since interviews tend to have repeating forms of questions, by interview #8 vs interview #2, they will do much better, and they will pass most of these tips. The thing is although, they will perform identically on the actual job, so what are you actually filtering for? I feel like 'tell me what you don't like about your previous work place' or the reverse 'what do you like the best about your workplace' feels like the new 'what is your greatest weakness' interview question. All your doing is filtering out for is some sort of quickly learned social inexperience. To see how common the mistakes I mentioned are, go see here: http://workplace.stackexchange.com/ I think this is a more accurate way of thinking about hiring engineers: http://sockpuppet.org/blog/2015/03/06/the-hiring-post/

To quote you: “ (I'm among an elite cadre† of cryptography-adjacents who felt it probably wasn't, but only because I thought it was too stupid to actually be used anywhere --- as soon as it was disclosed that (a) it was a default-yes algorithm in BSAFE and (b) big companies actually used BSAFE in important products, it was immediately clear what was going on).” The BSAFE disclosure happened in 2013 with Snowden. In 2015 you published an article still questioning whether Dual-EC was a backdoor, and providing an immense amount of plausible deniability for folks like Hoffman. https://sockpuppet.org/blog/2015/08/04/is-extended-random-malicious/ You don’t even remember the historical Ptacek Gut Logic!