⚡ Comprehensive Privacy-First Internet Services
#OpenSource #DigitalRights #CyberPunk #Anonymity #InfoSec #Tor #Cryptography #NoTracking #DigitalRights
Posts
A public project should not be credible only because it appears online.
This is why I am using ProofBundle for the projects I publish and discuss publicly, including the ones I present here on LinkedIn.
ProofBundle creates a portable cryptographic proof for a project snapshot.
It takes the files, builds a deterministic SHA-256 manifest, reduces the entries into a Merkle tree, and produces one Merkle root for the whole project state.
Then that root is bound to a signed author/custody claim.
ProofBundle can also use OpenTimestamps: the Merkle root and manifest hash are timestamped and anchored to public blockchains, without uploading the original project and without putting the contents on-chain.
So the proof has three layers:
- integrity: SHA-256 hashes, manifest, and Merkle root
- identity/custody: Ed25519 or OpenPGP signature
- time evidence: OpenTimestamps blockchain anchoring
For signing, ProofBundle supports a default Ed25519 mode: modern, compact, and easy to verify.
It can also use a detached OpenPGP signature, including OpenPGP keys based on Ed25519. And for stronger key custody, OpenPGP signing can optionally be backed by a YubiKey, so the private signing key stays hardware-backed and non-exportable.
This is not copyright registration and it is not a legal shortcut.
It is technical evidence that:
- this exact project state existed
- these files matched this manifest
- this Merkle root represented the snapshot
- this key signed the claim
- the timestamp evidence was
anchored through OpenTimestamps
- the proof can be verified independently
Full technical note: https://www.gabrielesalati.eu/blog/proofbundle-verifiable-project-integrity.html
#ProofBundle #OpenTimestamps #Blockchain #OpenPGP #Ed25519 #MerkleTree #YubiKey #CyberSecurity #SoftwareEngineering #OpenSource
Moved servers, and every Gemini capsule started screaming "untrusted server." Why: my old server (agate) only does self-signed TOFU certs, no CA chain and clients had the old fingerprints pinned, so they rejected the new ones too. Fix: patched gmnisrv to send a full Let's Encrypt chain, forced TLS 1.3, and fixed a crash where a big chain overflowed the handshake buffer (a free DoS on a public port). Renewals auto-reload now.
Patched fork: https://git.virebent.art/virebent/gmnisrv
Live, CA-verified, TLS 1.3:
- gemini://contact.virebent.art
- gemini://virebent.art
- gemini://archives.virebent.art
- gemini://n5ry24fweklbn562o7fnyefanygtwxlgi7aevn26huuxqlsftxy5ljqd.onion (self-signed —
If your client grumbles once about a changed cert, accept it. That's TOFU.
Best regards and have fun !