Filippo Valsorda

I also attended the Recurse Center years ago, but it didn’t quite click for me, which was surprising because everyone I spoke to had such positive experiences there. Even now, I find it hard to pinpoint exactly why it didn’t feel worthwhile for me. Perhaps it was the location. New York City is expensive, and although I had enough savings to justify taking unpaid leave from work, many things seemed unreasonably priced. New Yorkers also have a reputation for being unfriendly, which added to my feeling of disconnect. Despite hearing glowing reviews from others, I didn’t quite mesh with the environment at Recurse Center, similar to how some visitors to the city might not feel entirely welcomed during certain encounters. On the bright side, some of the residents and alumni [1] have become quite well-known in the tech industry. You might get lucky and find one of them around the space, which could lead to some really insightful conversations. During my time there, I had the chance to meet people like Robert Lefkowitz [2] and Filippo Valsorda [3], which was pretty cool. They definitely added some interesting perspectives to my experience. [1] https://www.recurse.com/residents [2] https://www.linkedin.com/in/r0ml [3] https://filippo.io

> So what do you use for signing and encryption today when setting up a heterogeneous system like email or git? I don't. For Email, quoting the aforementioned post[0]... > Encrypting Email > Don’t. > Email is insecure. Even with PGP, it’s default-plaintext, which means that even if you do everything right, some totally reasonable person you mail, doing totally reasonable things, will invariably CC the quoted plaintext of your encrypted message to someone else (we don’t know a PGP email user who hasn’t seen this happen). PGP email is forward-insecure. Email metadata, including the subject (which is literally message content), are always plaintext. > This isn’t going to get fixed. To make actually-secure email, you’d have to tunnel another protocol over email (you’d still be conceding traffic analysis attacks). At that point, why bother pretending? > Encrypting email is asking for a calamity. Recommending email encryption to at-risk users is malpractice. Anyone who tells you it’s secure to communicate over PGP-encrypted email is putting their weird preferences ahead of your safety. For signing commits in git, I'll quote Filippo[1]'s 'Sigining git commits considered harmful'[2] rant on Twitter. > One of my issues with it is that it's marketed for a problem it does not solve (git metadata authentication and identity) and it's way suboptimal for the problem it solves (signed releases). > I don't believe it works for that. You need at least a rebase (and key rotation, and…

I love how proactive the crypto team is about post quantum. They released https://pkg.go.dev/crypto/mldsa. The lead maintainer Filippo Valsorda wrote a nice piece here[1] to urge the tech world to start deploying good enough versions of post quantum crypto. [1] https://words.filippo.io/crqc-timeline/

That last sentence is not true; we have gotten much closer to building a quantum computer that can run Shor's algorithm. Organizations like Google and Cloudflare have declared a 2029 deadline to completely stop depending on the security of pre-quantum algorithms; hitting that deadline is going to cost a lot of engineering resources, but they're paying that cost because they think there's too great a chance that nation-state adversaries will have scalable quantum computers by then. See https://words.filippo.io/crqc-timeline/ and the various posts linked therein, including from the aforementioned companies.

> The bet is not “are you 100% sure a CRQC [cryptographically-relevant quantum computer] will exist in 2030?”, the bet is “are you 100% sure a CRQC will NOT exist in 2030?” — from https://words.filippo.io/crqc-timeline/ "A Cryptography Engineer’s Perspective on Quantum Computing Timelines", the OP's blog post from two weeks ago, and the first link in this one. [HN discussion: https://news.ycombinator.com/item?id=47662234] Yes today's quantum computers cannot factor 21, but enough progress is happening fast enough that now there's a >1% chance they will go much further in (say) five years. More broadly (outside of relevance to cryptography), quantum computers already can (almost certainly) beat classical computers on certain contrived (useless) problems: see https://arxiv.org/abs/2603.09901 "Has quantum advantage been achieved?" for a summary of the current state.

> from a classical security point of view PQC cannot be trusted [citation needed] https://words.filippo.io/crqc-timeline/#fn:lattices

The author of AGE has a great point in the below blog post [0]: If you use something like SOPS or just check age secrets into a git repository next to source code, you need an authentication story for the whole repository. Having authentication for the secrets will do nothing if the attacker can change the source code that decrypts and uses them. That story can simply be “we trust GitHub” like most projects. Encrypting secrets with age will keep them confidential even if the project is Open Source, and anyone wanting to replace them will have to make a PR even if they can generate a new valid age file. 0 - https://words.filippo.io/age-authentication/

AES-IGE is not best practice. Neither is this https://words.filippo.io/dispatches/telegram-ecdh/ The difference is Moxie isn't an amateur when it comes to cryptographic design. Wikipedia actually lists him as a cryptographer. The company has also employed an actual mathematician/cryptographer, Trevor Perrin. Meanwhile, Telegram employed the CEO's brother who's a geometrician, which is not the same. You wouldn't hire a dentist to perform brain surgery even though both studied medicine. Signal protocol's double ratchet is considered best practice by pretty much every competent cryptographer. MTProto's main issues are not the teething issues of the yester-years. It's the fact every chat is sent to the server that can then read the messages. Telegram only has E2EE in internet debates about it's non-existent E2EE in practice.

Age (and its rust implementation Rage) combined with agenix[0] and age.el[1] has made my self-hosted deployment and management so, so easy without compromising security. That, when combined with general NixOS conveniences is why I'm able to self-host at all. If not for these, just the anxiety of having to setup new server in case of whatever loss and the associated time/opportunity loss kept me from dong the same for years. Anyway, just want to say that Age is great! P.S. The author also did an analysis of Restic the backup tool [2] which also prompted me to setup nice backup solution for my machines. Pretty cool. [0]: https://github.com/ryantm/agenix [1]: https://github.com/anticomputer/age.el [2]: https://words.filippo.io/restic-cryptography/

One of the folks behind this effort, Filippo (https://filippo.io/) is now, as he calls it, a full time professional open source maintainer https://words.filippo.io/full-time-maintainer/ > That means I spend most of my time on maintenance, and I offer retainers to companies that benefit from my work and from access to my planning and my expertise. He is trying a new way of life for highly-skilled OSS maintainers. Hopefully this works out well for him.

> Here is an application written with golang, decompiled with IDA 8.3 Pro, we can see that IDA not only restores all the function names, but also restores the business code with good readability. > And this program has used -ldflags "-s -w" to remove the debug information and symbol information when compiling, which shows that if no processing is done for the program written in golang, there will be no secrets at all. Though perhaps those flags were just not effective. Maybe Go places it's own stuff after the user-specified flags, or maybe they're only used in cgo mode? Edit: https://words.filippo.io/shrink-your-go-binaries-with-this-one-weird-t… It retains the symbols needed to format stack traces, so most symbols remain. So go-link's "-s" is rather different from how normal linkers interpret "-s" (don't link symbols or debug information, functionally equivalent to strip(1)).

Well, there are two “problems” with these kinds of blogs: a) They’re not that super easy to discover these days, and b) Writing high quality text takes time, and the authors tend to be quite busy people, so they are not updated frequently. I guess that’s part of the appeal of Medium. They have a method for discoverability, and lots and lots of authors means lots of text to read. I’m not 100% sure exactly what my gripes with Medium are, but I guess that it feels a bit like a text factory. Personally, I prefer a more decentralized approach than what Medium offers. However, I don’t use RSS at all. For me, finding blog posts via HN and Lobsters is sufficient – YMMV. With that said, one of the best technical “blogs” I know of is actually a newsletter: Cryptography Dispatches. It has a feed, I can warmly recommend it! https://words.filippo.io/rss/

It is idiosyncratic but it's not a bad recommendation, right? AES+HMAC-SHA2 would be AES-CTR and you would need to handle the nonce yourself, and that's not great. XChaCha is extended nonce, which should be safer. But there is no standard for extended nonce AES. Filippo Valsorda wrote that he would like XAES-256-GCM/11 [1] XChaCha looks like a good recommendation. Because lacking key commitment can lead to problems, a scheme that also gives you key commitment is better [2]? So that's not crazy. What does Google Tink do by default / recommend? What does Sophie Schmieg or whoever recommend? 1 - https://words.filippo.io/dispatches/xaes-256-gcm-11/ 2 - https://eprint.iacr.org/2020/1153.pdf

https://words.filippo.io/full-time-maintainer/ represents an attempt to find a sustainable answer to some parts of this issue. I'm not sure whether it's appropriate to attempt that model wholesale in your particular case, but it may be worth reaching out to Filippo for a conversation.

Filippo Valsorda is now an independent consultant https://filippo.io/

There are a couple solid summaries in that thread based on my experience going through that exercise - thanks for the link In case anybody wants to go down the rabbit hole of shit you should definitely not use in production (but we did anyway), this was my starting point: https://words.filippo.io/rustgo/ I did not, however, `no_std` or avoid heap allocation on the Rust side. Everything worked great, including running a multithreaded tokio runtime. Still do not recommend in prod ;)

Correct. In the status quo, you will be best-served by looking at solutions similar to what Plex is shipping (https://blog.filippo.io/how-plex-is-doing-https-for-all-its-users/). ACME's DNS-based challenges might even make this easier today than it was when that mechanism was designed. Longer-term, it seems clear that it would be valuable to come up with ways in which we can teach browsers how to trust devices on a local network. Thus far, this hasn't been a heavy area of investment. I can imagine it becoming more important if we're able to ship restrictions like the ones described here, as they do make the capability to authenticate and encrypt communication channels to local devices more important.

https://blog.filippo.io/shrink-your-go-binaries-with-this-one-weird-tr… This is great article instructing how to shrink the Go Binaries. Author is lead of cryptography and security team of Go Team at Google.

I recently read about how Plex got trusted SSL certificates for all their users in partnership with DigiCert, and was really curious if a similar scheme could be accomplished with Let's Encrypt. The scheme required wildcard certificates so I figured it wouldn't be possible. But with this announcement, maybe it would be! I work on a product that generates a self-signed cert and so our customers always get a cert warning. They can replace the cert with their own if they like, but some customers aren't set up to do that. Offering an alternative where we securely mediate creation of a trusted SSL cert would be fantastic. See: https://www.plex.tv/blog/its-not-easy-being-green-secure-communication… and https://blog.filippo.io/how-plex-is-doing-https-for-all-its-users/

With this caveat: https://blog.filippo.io/ssh-whoami-filippo-io/ (Granted you can turn you can stop this client-side, but it's worth noting that your SSH client will generally identify you to a server on connect.)

There's a big discussion about PGP here and why so many fail to use it: https://news.ycombinator.com/item?id=13114538 Some of the comments are worth reading if not for the sheer size of the discussion. It could take an afternoon or two to fully digest that thread. The comments are in response to this: https://blog.filippo.io/giving-up-on-long-term-pgp/

The previous article, about a lost password for a NAS, is hilarious and well worth a read as well: https://blog.filippo.io/so-i-lost-the-password-of-my-nas/

> that the hardware involved in the actual key rollover complies to the highest level specified by FIPS-140 (presumably actually FIPS-140-2). Eww, FIPS-140-2. FIPS-140 compliance isn't a selling point. It's more of a genetic marker than anything. Most of the time, it signals to hackers, "we value standards compliance over security." Did you know that ECB mode is FIPS-140-2 approved, but AEAD modes (i.e. what you should be using to encrypt) such as GCM and OCB are not? Yes, that ECB mode. https://blog.filippo.io/the-ecb-penguin/

A reply disagreeing got deleted, but in case anyone else is wondering, you're trusting your ISP because SMTP's STARTTLS, the most standardized, widespread email "encryption", is basically worthless[1] if you're really paranoid. It's not required, so if you try to require it you're going to be unable to receive/deliver some email. It's negotiated over plaintext, so ISPs in between can just make the two servers think each other doesn't use it. I believe there's also some confusion in the standard, or at least widespread bad implementations, about how to verify the certificate, so an attacker can probably MITM the cert too. You can of course encrypt the mail yourself with GPG etc, but that would make self-hosting, the topic of this sub-thread, less relevant, and nobody but your fellow cryptonerds will do it. [1] https://blog.filippo.io/the-sad-state-of-smtp-encryption/

https://filippo.io/psa-enable-automatic-updates-please/ I can also recommend to enable automatic updates. It won't hurt, and if it does, it will be far less than a hacked server can cause in amount of damage.

Heartbleed is not super descriptive to layfolk but it's certainly catchy, I'll give you that. Having a dot-com domain with said simple name was great, too. But the content? A loud reminder indeed. As a member of the dev community, I would have wanted to see the following: 1. How bad is it? If you're using SSL, then an attacker may be able to read your machine's memory without leaving a trace. 2. Who is affected? Users of OpenSSL versions X-Y. Check your site here [http://filippo.io/Heartbleed/], but your client code may be affected too! 3. How do I secure myself? Update to OpenSSL version Z, reboot, and consider resetting all sensitive data on your server (reissue your SSL certificate, reset your user passwords and sessions, etc). These facts are littered throughout a 2,000+ word document. In the future, I would like to see these things answered plainly at the very top.

> But if I recall, it seems that the age key file itself is 128 bits! Thus in the symmetric mode, Age provides only 128 bits of security. This is substandard, and in particular secure only until 2035 or so. This is not the case. To meet NIST's Category 1 requirements, post-quantum cryptography "must require computational resources comparable to or greater than those required for key search on a block cipher with a 128-bit key (e.g. AES128)" [0]. It is therefore completely appropriate to pair any Category 1 post-quantum KEMs with 128-bit symmetric keys. See [1] for more details about post-quantum age. Symmetric passphrase age similarly is fine because it's the same as the post-quantum KEM case but without the KEM. [0] https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-… [1] https://words.filippo.io/dispatches/post-quantum-age/

That is probably true, when you live in a society where you probably still want some money for your work. The greater implications of that might have something to do with how we get articles like "Software below the poverty line": https://staltz.com/software-below-the-poverty-line.html Or maybe the revelations about how "well" supported the people who maintained Log4j were from the open source community: https://words.filippo.io/professional-maintainers/ Earlier this week, a severe RCE in a logging library called Log4j2 got everyone, from Apple to Minecraft. As of yesterday, the maintainer who patched the vulnerability had three sponsors on GitHub: Michael, Glenn, and Matt. That's why it's hard to be angry with companies and people trying to get paid for their work, supported by various software licenses in one way or another. I do still mostly support open source in spirit, though doing that with my wallet on OpenCollective (or GitHub Sponsors or whatever) is also a good thing to do.

Indeed. And the readme and the usage output makes no mention of streaming, buffering, on-line, authentication, or anything related. This is a potential security relevant behavior that most users-- who haven't written or analyzed tools like this-- would find surprising. For those following along, I went and tested it-- since the behavior wasn't documented or clear from the code. If it encounters midstream corruption it truncates the output, exits with a non-zero return and prints some error text std stderr: "Error: chacha20poly1305: message authentication failed\n[ Did age not do what you expected? Could an error be more useful? Tell us: https://filippo.io/age/report ]" If the input is truncated, it either does that-- or if the truncation is on a block boundary it prints "Error: unexpected EOF\n[ Did age not do what you expected? Could an error be more useful? Tell us: https://filippo.io/age/report ]" instead. It's not a problem, but it should be documented.

> I'm sorry for your bad experiences with the Palemoon guys. You are obviously not who this software is meant for. Who is it meant for if it's not meant for users? Are they intentionally trying to turn away certain people? > I don't need or want sandboxing for my extensions I think you'll find with all security, it's best to have the "principal of least privilege" https://en.wikipedia.org/wiki/Principle_of_least_privilege at all levels of software. The reason for this is because if something happens to exploit one area of your setup, the hope is that it will be stopped somewhere else. > I can take care of my own sandboxing external to the browser profile instance. As do I. I use multiple VLANs (network segregation), Virtual Machines, and other things in addition to browser profiles. Most people however do not. Software should be designed for "most people". > And I don't want it either, because it makes them less flexible and powerful. XUL based extensions turn my browser into a power tool, There's plenty of frameworks out there. Perhaps what you're trying to do shouldn't be a browser extension. > Chrome is a toy. Okay if you mean high performance web browser with a lot of market share that Mozilla must compete against in order to stay relevant? > I don't know why you are upset, because the vast majority of the Internet agrees with you. They do because I am right. I rarely say this as I do often like a good debate, however in this situation I will. > Most people…