← Feed

Posts

• Post #4492989

  This is a really interesting and thorough experience report of deploying Device-Bound Session Credentials. My feeling is that DBSC needs another spec iteration or two before being ready for wide deployment. My guess is that if it does catch on, we’ll see attacks move from exfiltrating session cookies to proxying requests through the user’s browser/device - as we’ve seen in the past eg with HttpOnly cookies. Without an equivalent of WebAuthn’s UserPresence bit, I’m not sure this is a long-term so...

• Post #4432915

  Ha! A friend of mine is using ChatGPT to write a personal statement for a job application (Yes, I am judging them). They sent me a screenshot of it telling them “I actually don’t want to write this statement tonight.” Literally the deadline for applications… AI will multiply productivity, except when it’s being too sassy, apparently. Wat.

• Post #4359330

  Discovered this beautiful Big Star cover of Don’t Worry Baby earlier. (From a comment on an Instagram reel of someone else doing a pretty good cover too). https://youtu.be/PqlHiWrVGag

• Post #4358231

  RE: https://fosstodon.org/@bsdphk/117032189389327188 “NVD quickly flagged these as critical, and CISA's ADP agreed. But when JFrog security researchers dug in to verify, the claims fell apart.” More garbage from NVD. Do they spend more than 5 minutes “enriching” CVEs?

• Post #4348640

  Many times in my career I’ve found myself working on software that is 15-20+ years old and has seen multiple generations of developers come and go. What strikes me is that the VCS history is never complete. Large swathes of early design decisions and context are missing. I find there’s often a sort of folklore history that then develops, with collective imagining of why certain features exist or are designed the way they are. Often these post-hoc rationales don’t really hold up to scrutiny, or a...

• Post #4279840

  ICYMI: The bugs Anthropic #mythos found in crypto code are interesting, but not astonishing. Write ups from cryptographers: Matthew Green: https://blog.cryptographyengineering.com/2026/07/29/some-notes-about-anthropics-new-results/ JP Aumasson: https://www.bfswa.blog/p/llms-wont-break-symmetric-crypto tl;dr - the break of HAWK post-quantum signature scheme is not fatal but makes it much less attractive as a standard once parameters are adjusted. The “attack” on AES is of theoretical interest...

• Post #4272218

  Q: in 2026, do we really still need to be producing both .tar.gz AND .zip files? Surely we can just pick one?

• Post #3983382

  Fondly remembering the good old days when it was blockchain fanatics spamming the mailing lists I care about. At least they wrote their own emails.

• Post #3697886

  9.28GB. 8 new emoji as the headline feature.

• Post #3632926

  Huh. I just opened search on my iphone and before I started typing anything it suggested I call my grandmother. Nice idea, but she’s been dead for 20 years.

• Post #3576755

  What I don’t understand about the whole TLS ML-KEM debacle: why do it through the IETF at all, and kick off this nonsense? The registration requirements for TLS parameters are “specification required” AIUI, so any SDO can issue a spec and register the codepoints with IANA, with just a nod from the designated experts. Why pick this predictable public fight?

• Post #2049443

  Sometimes all you have is a private key and you need the corresponding public key. Today’s “fun” puzzle: implementing this for a range of key types in Java, using only standard library APIs (no BouncyCastle). Some clever/evil hacks needed. https://codeberg.org/neilmadden/snippets/src/branch/main/PrivateToPublicKeyConverter.java #java #cryptography

• Post #1005881

  I’m willing to believe that Anthropic built a better SAST. But that’s a total market of about $5B tops according to Google (some estimates seem to be just $0.5B) – it’s going to take a while to pay off their $30B Series G if they keep targeting these relatively tiny markets. The same as with targeting developer productivity (another famously quite small market), they are focused on these markets because there are existing automated “bullshit-corrector” tools. In the case of software development...

• Post #679461

  It just occurred to me that if hash functions are message “digests”, then the output of such digestion is…. 💩 Brb, implementing constant-time turd comparison.

• Post #662338

  “What I mean is that if you really want to understand something, the best way is to try and explain it to someone else. That forces you to sort it out in your own mind. And the more slow and dim-witted your pupil, the more you have to break things down into more and more simple ideas. And that’s really the essence of programming. By the time you’ve sorted out a complicated idea into little steps that even a stupid machine can deal with, you’ve certainly learned something about it yourself. The t...

• Post #509194

  Looking for vulnerabilities is the last thing I do There's a common misconception among developers that my job, as a (application) Security Engineer, is to just search for security bugs in their code. They may well have seen junior security engineers doing this kind of thing. But, although this can be useful (and is part of the job), it's not what I focus on and it can be counterproductive. Let me explain. http://neilmadden.blog/2026/02/20/looking-for-vulnerabilities-is-the-la...