@soatok@furry.engineer

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Aug 04, 2026

Had a dream I was talking to someone and they told me their middle name was "Sunday" but they were thinking of changing it to "Bureaucratic Friday" I woke up trying to figure out which way they intended the joke

19

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Aug 04, 2026

Boosted by

Furbland's Very Family-Friendly Account™ @GroupNebula563@mastodon.social

cults, conspiracy theories, misinformation, geopolitics, social media, you name it tbh Hover or focus to reveal Sensitive

The title of this video did not disappoint https://www.youtube.com/watch?v=6zLCZ_Ic1hI

5

1

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Aug 04, 2026

Replying to @mattblaze@federate.social

@mattblaze@federate.social I dunno about everyone else, but I plan to be walking around in fursuit!

0

1

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 30, 2026

I get some weird emails. How do I break it to them that "Barkane Arts" is a joke organization name that I came up with as a play on the term "computer wizardry" (but with more furry) rather than an LLC registered in any state?

12

0

1

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 30, 2026

Every time the Red Cross declares a different level of alarm over blood shortages, my gay ass who is excluded from donating blood is like "Hmm, do I want to abstain from gay sex for a full calendar year in order to help fix a problem for a system that discriminates against people like me?" and then I shrug.

126

9

33

1

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 30, 2026

I suspect someone's using an LLM to scrape all of my writing whenever I see anomalies like this.

11

1

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 29, 2026

Replying to @soatok@furry.engineer

It's around 3 AM on a weekday and I'm writing a long thread. Do you feel lucky? Hover or focus to reveal Sensitive

But let's be real: At least 10% of my reason for doing any of this is because I'm a shitlord at heart. Do you know how funny it is for folks at cryptography conferences to be like, "Oh I helped design the Keccak permutation that became SHA-3 and later went on to work on sponge-based authenticated ciphers?" And to want in that moment to be like, "I have a blog. It has stickers!" You have to be willing to make a total fool of yourself for your own amusement to understand me at all.

18

1

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 29, 2026

Replying to @soatok@furry.engineer

It's around 3 AM on a weekday and I'm writing a long thread. Do you feel lucky? Hover or focus to reveal Sensitive

(I included Tao in the last post mostly as a joke because, despite his success in mathematics, he comes across as humble and approachable in everything he writes, and I admire that.) You can do this too. Maybe don't roll your own crypto today. That's a team project anyway.

9

1

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 29, 2026

Replying to @soatok@furry.engineer

It's around 3 AM on a weekday and I'm writing a long thread. Do you feel lucky? Hover or focus to reveal Sensitive

Whenever I'm confronted by these sorts of judgments, I'm never quite sure how to feel (let alone react). Like, sure, it's flattering. I can take compliments! (If by "take" you actually mean "skillfully deflect", heh. :P) But I don't like the weird framing it implies. Cryptography isn't hard because you need to be part of the Special Boys Club of Mega Geniuses. (I guess they call that Mensa?) Cryptography is hard because it can go wrong in a lot of subtle ways, many of which fail silently while offering false confidence that puts people in harm's way. Cryptography requires training, discipline, and a deep curiosity to keep up-to-date with new attacks and blind spots in earlier designs. It doesn't require being, like, Terrance Tao or Albert Einstein.

13

1

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 29, 2026

Replying to @soatok@furry.engineer

It's around 3 AM on a weekday and I'm writing a long thread. Do you feel lucky? Hover or focus to reveal Sensitive

Pulling off a career switch isn't easy, and it requires some degree of privilege to be successful at all, but it's possible. "We have the technology", except not entirely ironic.

11

1

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 29, 2026

Replying to @soatok@furry.engineer

It's around 3 AM on a weekday and I'm writing a long thread. Do you feel lucky? Hover or focus to reveal Sensitive

None of what I described requires a bigger or more special brain to do. Hell, almost anyone can pull this off if they have the right opportunities and invest the time to learn it. In 2020, I wrote a series to help people get into tech. https://soatok.blog/furward-momentum-starting-and-growing-an-open-source-project/ Most of what still works today (current job market being what it is) isn't the hard skills part, it's the first step of building a support system.

13

1

2

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 29, 2026

Replying to @soatok@furry.engineer

It's around 3 AM on a weekday and I'm writing a long thread. Do you feel lucky? Hover or focus to reveal Sensitive

But it's also just... not true of me at all? I'm a dumbass quite often. I'm just not afraid to be a dumbass, nor am I in denial about my tendency to make blunders. My job title is some variant of "Security Engineer"; has been for many years now. Security Engineering is related to Safety Engineering. Both disciplines are about studying Failure. Understanding how systems fail is half of my job. The other half is a weird form of group therapy.

20

1

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 29, 2026

Replying to @soatok@furry.engineer

It's around 3 AM on a weekday and I'm writing a long thread. Do you feel lucky? Hover or focus to reveal Sensitive

At the top of the list, blogging about cryptography is something I do, in part, because excessive gatekeeping is counterproductive and even toxic. See https://soatok.blog/2021/03/04/no-gates-no-keepers/ for more on the subject ^^

16

1

5

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 29, 2026

Boosted by

Furbland's Very Family-Friendly Account™ @GroupNebula563@mastodon.social

It's around 3 AM on a weekday and I'm writing a long thread. Do you feel lucky? Hover or focus to reveal Sensitive

This week, something reminded me of a weird experience I've had over the years. I was probably intending to blog about it at some point, but it's a difficult topic to cover without sounding weirdly self-congratulatory, and I kind of hate that tone. I dunno, maybe it's from years of working in tech? :V One of the hazards you'll face if you share any of my hobbies or interests is other people--well-meaning, honest, and usually very kind people--praising your apparent "intelligence". This has also come up a few times indirectly, where friends would be like, "So I asked my [very technically respected] friend about you, and they said cryptography is only for mega-geniuses." This sort of experience, however it manifests, makes me feel uncomfortable for many reasons.

0

1

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 27, 2026

Replying to @womble@infosec.exchange

@womble@infosec.exchange @securingdev@infosec.exchange sashimi then?

2

1

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 19, 2026

lewd joke Hover or focus to reveal Sensitive

I don't drink alcohol but at furry room parties I'm known to ask for something stiff

11

1

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 19, 2026

Replying to @m0nad@infosec.exchange

@m0nad@infosec.exchange "Would you like CVEs with your McSlop?"

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 16, 2026

The prevalence of spaghetti code in core infrastructure is clearly a homage to the Church of the Flying Spaghetti Monster.

17

1

8

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 16, 2026

Replying to @ww@xyzzy.link

@ww@xyzzy.link @hazelnoot@enby.life @azonenberg@ioc.exchange An extension would be secure against any instance being compromised unless the author of the extension is also compromised. If furry.engineer got pwned after this is all rolled out, there's nothing I could do to stop JS served from furry.engineer from stealing my private keys, etc. However, a browser extension that does all the encryption, signing, and key management outside of the Fediverse domain's DOM entirely would be impervious to malicious JS. The downside is, as you say, the extension authors could also be compromised. But at least now we're talking about "the evil government needs to push malware onto the endpoint" rather than "passively just snoop on what the server receives for years". The cost of the attack is much, much higher. (Also, y'know, binary transparency, reproducible builds, and open source software can help!) https://defuse.ca/triangle-of-secure-code-delivery.htm cc @DefuseSec@infosec.exchange

0

1

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 16, 2026

Replying to @azonenberg@ioc.exchange

@azonenberg@ioc.exchange @hazelnoot@enby.life Browser extensions are your only secure option if you want to use a "web frontend".

2

1

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 16, 2026

Replying to @hazelnoot@enby.life

@hazelnoot@enby.life This was prompted by https://pawb.social/post/47167667/23257426 lol

0

1

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 16, 2026

RE: https://furry.engineer/@soatok/116925912306713260 I made a rather important update to this post for folks who hadn't been chewing on the threat model of E2EE for the past 4+ years. https://soatok.blog/2026/07/15/the-long-tail-of-work-left-until-activitypub-has-e2ee/#public-key-profile

Quoting

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer

https://soatok.blog/2026/07/15/the-long-tail-of-work-left-until-activitypub-has-e2ee

Open quoted post

3

1

3

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 15, 2026

Replying to @soatok@furry.engineer

I had to repost this manually because the WordPress.com / Jetpack social plugin didn't include the hecking preview image >.<

11

0

1

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 15, 2026

https://soatok.blog/2026/07/15/the-long-tail-of-work-left-until-activitypub-has-e2ee

72

11

55

2

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 15, 2026

The Long Tail of Work Left Until ActivityPub Has E2EE Separate from my proposal for key transparency for the Fediverse (which I've certainly blogged about a lot), the W3C has been…... http://soatok.blog/2026/07/15/the-long-tail-of-work-left-until-activitypub-has-e2ee/

2

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 15, 2026

Amazon can't help themselves when it comes to including "Simple" and "Managed" in a new service name because, looking at their warehouses, the upper management is clearly into S&M.

18

1

3

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 14, 2026

Replying to @cliffle@hachyderm.io

@cliffle@hachyderm.io Alan Turing appreciation is the gay option Alan Turing fanfiction is the gayer option Neither precludes "Yes" or "No"

4

1

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 14, 2026

Replying to @soatok@furry.engineer

Since the poll is closed: The consensus is "No". Which is also what I believe. Happy to be proven wrong, of course.

0

1

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 14, 2026

Me, months ago: "Wow, there's nothing I feel like writing about. Work is extremely busy. I'll put it off." Me, now: "Wow, there are so many things to write about that it's hard to choose which one to finish first. Work is extremely busy. I'll put it off."

4

1

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 10, 2026

Vaguely incorrectly remembering the time when @sophieschmieg@infosec.exchange : "The empty string is the prefix to all strings" People doing domain separation wrong:

71

5

15

1

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 09, 2026

Replying to @soatok@furry.engineer

Context: https://geekfeminism.fandom.com/wiki/Jacob_Appelbaum_rape_reporthttps://medium.com/@hdevalence/when-hell-kept-on-payroll-somewhere-is-where-you-are-f419d3022d0

7

1

2

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 09, 2026

mention of celebrated rapist Hover or focus to reveal Sensitive

looking at IETF mailing list Boy, Jacob Appelbaum's understanding of KEMs is as shallow as his apparent understanding of boundaries and consent, huh?

36

5

6

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 09, 2026

Since the EU has made Chat Control 1.0 a thing, I should remind everyone that even having a plaintext mode at all is gross negligence for an E2EE system https://www.patrick-breyer.de/en/eu-parliament-greenlights-chat-control-1-0-breyer-our-children-lose-out/

101

13

95

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 07, 2026

Replying to @tmaher@infosec.exchange

@tmaher@infosec.exchange X.680 5.7 discusses recursion

6

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 07, 2026

OK, help me settle a debate. Is ASN.1 Turing complete? (Accidentally Turing Complete counts. Proofs of concept are welcome.)

Yes, ASN.1 is TC

7.6% (27)

The gayer option

48.9% (174)

No, ASN.1 isn't TC

12.4% (44)

Schrodinger's cat

14.6% (52)

The gay option

16.6% (59)

356 votes Poll closed

View on furry.engineer

0

14

32

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 07, 2026

The specification for Post-Quantum signature algorithms for HTTP Message Signatures (IETF RFC 9421) is now live. http://c2sp.org/httpsig-pq@v0.1.0

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 07, 2026

I understand why they're important/useful/whatever for businesses, but I hate doing self-assessments. At the end of the day, if I were a bullshit artist, I could spin my past six months as 10/10 on pretty much all metrics. But I am not so arrogant.

43

1

8

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 07, 2026

RE: https://mastodon.scot/@kim_harding/116878280185730300 It would be so fucking funny if they lose

Quoting

kim_harding ✅ @kim_harding@mastodon.scot

Zuckerberg’s biggest legal nightmare yet could cost Meta $1.4 trillion https://www.the-independent.com/tech/mark-zuckerberg-meta-fine-trillion-b3010281.html Meta Platforms said in a court filing on Monday that four states were seeking $1.4 trillion in penalties over accusations that the company designed its Facebook and Instagram platforms to addict young users. Bring it on!!!

Open quoted post

41

0

6

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 06, 2026

Hey, reminder if you're new here: https://soatok.blog/2024/09/09/doesnt-matter/

2

1

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 06, 2026

Well, shit. Signal now lets group admins delete for everyone. So now you can curate your discussion groups and delete messages that aren't welcome.

9

1

4

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 05, 2026

Replying to @soatok@furry.engineer

The worst offenders are the sovereignty-pilled European tech bros who think plaintext-in-Europe is just fine. I argue that well-implemented cryptography ia resilient even when your governments go more authoritarian. Hope isn't a strategy.

85

1

19

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 05, 2026

Me: "All the so-called private messaging apps have inferior cryptography engineering and need to step up their game. It kind of sucks that Signal is the only game in town that has decent e2ee. We can do better. The community just has to have higher standards and stop settling for bad designs." Random people: "Signal shill"

94

7

31

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 04, 2026

In some games, humans can wear two rings and a neck piece with enchantments. Furries should have a fourth accessory slot: A sort of bangle at the base of their tail.

53

13

9

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 03, 2026

Replying to @pq1r@tech.lgbt

@pq1r@tech.lgbt @christopherkunz@chaos.social Well, if you shift each letter of "DJB" one place to the left, you get "CIA". Illuminati confirmed dot gif

29

2

6

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 03, 2026

Replying to @soatok@furry.engineer

There are very intelligent and passionate engineers, cryptographers, and analysts that vehemently disagree with my conclusions about the Hybrid debate. That's okay! But Bernstein summoned a mob of ill-informed people with messages designed to alarm them into action.

34

1

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 03, 2026

Replying to @soatok@furry.engineer

Every one of these agencies has a mission and a budget. To your or I, that budget might seem like "damn near infinite", but they still have constraints. NSA has two missions. Everyone knows about SIGINT because of Snowden, but they also have a competing mission called COMINT. You can, very loosely, map these two terms to "red team" and "blue team". If NSA knew a top secret way to break ML-KEM and were fairly confident that no other country has thought of it, there is no way in hell the SIGINT people could get the COMINT people to agree on a plan to migrate the entire federal fucking government to use ML-KEM. It doesn't line up with their self-interest.

37

2

4

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 03, 2026

Replying to @soatok@furry.engineer

Like, I am NOT a fan of the NSA, in the same way that I'm not a fan of Meta, Palantir, and the data broker industry. Surveillance is bad for society. Privacy is good for society. Using technology to undermine privacy and surveil people is a bad thing, actually. And while the official story is roughly that NSA only spies on other governments, and not innocent civilians, we have no way of knowing if that's true. And there's no way in hell I'll ever trust that. So, like most cryptographers, I'm squarely in the "Fuck the NSA" camp. Just like I'm in the "Fuck the FSB" camp. And every other nation state's equivalent agency is on that list too. But spy agencies aren't fucking magical. They can't violate information theory, physics, or causality. They also aren't omniscient about mathematics, logic, or software vulnerabilities. If they were, they wouldn't have competition. And they can't wave a magic wand and get enthusiastic cooperation from international forums of cryptology experts. That's ridiculous.

98

5

25

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 03, 2026

Replying to @christopherkunz@chaos.social

@christopherkunz@chaos.social Yeah. Reasonable people can disagree on Pure PQ vs Hybrid PQ, but summoning unreasonable shit-stirrers into the thread is a huge waste of everyone's time and energy.

6

2

1

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 03, 2026

https://mailarchive.ietf.org/arch/msg/tls/T7z8M-wL_2nOpbJtehTqtGYjuWg/ I ran out of patience. This TLS thread is full of some of the dumbest fucking opinions I've read in a technical discussion in years.

22

2

4

0

Soatok Dreamseeker 🔜 DEFCON 34 @soatok@furry.engineer · Jul 01, 2026

Replying to @soatok@furry.engineer

I think what'a fundamentally happening here is that people on Lobsters (and, to a lesser extent, Hacker News) think I write blogs for them. Like I want their attention. Like I want their approval. Like I want to be one of them. Nope. I was never welcome in your spaces beyond some notion of "usefulness". You can even observe an echo of this observation in the comment thread. I am not, and never can or will be, a person of high esteem to that crowd. So why would I write for you? I write for my goddamn self. I write to help the people in my own space. Most are queer or furry (and the ones that aren't, simply don't mind that we are). They see me as part of a community, not some jackass on a pedestal that has to adhere to some abstract ideal of noble and/or academic etiquette. My writing is messy, raw, and real. What some people call arrogance or condescension is really frustration that, despite a better world being possible, egos get in the way of it happening. So, lol, no thanks.

0

Soatok Dreamseeker 🔜 DEFCON 34

Posts

OK, help me settle a debate. Is ASN.1 Turing complete? (Accidentally Turing Complete counts. Proofs of concept are welcome.)

Remote instance

Media