Simon Josefsson on nostr

Recent Notes

nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqnlau8hyd7g4cwta24s4cs8eulzryk9ffdm905jtmrdc2quvxyg6q85rnn3 Doesn't encrypt, doesn't deduplicate, and is also vibe coded.

Simon Josefsson @Simon Josefsson 1785134573

@nprofile1q... @nprofile1q... There are multiple rsync implementations around - and for dedup/rotation I’ve been relying on rsnapshot for 15+ years: https://rsnapshot.org/ - encryption I do on file system level to have lower complexity.

ARGVMI~1.PIF · 2w

nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpq3gjf0630d06k6f4scszak3yr4msg8xank9x5lx295p7r8sz8mwpqjcjf6c Won't work for me. I need to back up with different encryption keys onto the same backup drive. nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqnlau8hyd7g4cwta24s4cs8eulzryk9ff...

Simon Josefsson

@Simon Josefsson 1780346039

”Exploiting ML-DSA bugs” - graphing risks with ML-DSA vs Ed25519+ML-DSA. https://cr.yp.to/papers/mldsa-20260601.pdf

Simon Josefsson

@Simon Josefsson 1774852617

“Monitors 36 window.__oai_so_* properties tracking keystroke timing, mouse velocity, scroll patterns, idle time, and paste events. A behavioral biometric layer running underneath the fingerprint.” - how about saying that more clearly: Cloudflare installs a key logger in your ChatGPT browser session. Keystroke timing has been used to discover password, longer texts would be more predictable and easier to reconstruct. https://www.buchodi.com/chatgpt-wont-let-you-type-until-cloudflare-reads-your-react-state-i-decrypted-the-program-that-does-it/

Simon Josefsson

@Simon Josefsson 1769637546

Interested in SSH and Post-Quantum Crypto? Come to the #PQCSA workshop on Friday afternoon before #FOSDEM and hear my thoughts on the topic! https://www.esat.kuleuven.be/cosic/events/pqcsa-workshop-pqc-migration/

Alexandre Oliva · 28w

I'm not seeing the difference you're claiming. the SOF binaries and the signature (by an Intel-controlled secret key) on them work exactly like Tivo-supplied binaries and signatures (by a Tivo-contro...

Simon Josefsson @Simon Josefsson 1768921352

@Alexandre Oliva @[email protected] I’m no expert on SOF but I’m not sure this is a pure tivoization example? The SOF project contains a lot of FOSS code. But according to that documentation, it all requires a non-free signed firmware to be loaded. I’m not sure the source code for that firmware is public at all? But it doesn’t seem unlikely that (at least some parts of) SOF is still useful even if you don’t load that firmware.

Alexandre Oliva · 28w

from what I gathered when I looked into it, the firmware developed and distributed by the SOF project is all free software, and it's designed to always be signed in order for it to be loaded. the twist is that they've made a public signing key, that works on some devices, and a private signing key,...

Simon Josefsson

@Simon Josefsson 1768756120

TIL that the LinuxFoundation "Open source audio DSP firmware and development tools" project assumes signed proprietary firmware verified by Intel ME in your CPU. So much for "Open Source". https://thesofproject.github.io/latest/getting_started/intel_debug/introduction.html#base-firmware

Simon Josefsson

@Simon Josefsson 1767096402

Thinking of cleaning up your hard drive? DONT DO IT! IT IS A TRAP! I've wasted half of this morning iterating through old work. I'm currently in ~/src/old/emacs-18.59+jas/lisp/ trying to see if some ISO-8859-1 hacks can be rescued and made to run. Version control with CVS wasn't a thing, and now I regret trying to see where I left off in the RCS *,v files... Time To Walk Away Calmy #rabbithole

Simon Josefsson

@Simon Josefsson 1765734834

GNU InetUtils 2.7 with Sigsum proofs in the stable `sigsum-generic-2025-1` policy #gnu #sbom #sigsum https://lists.gnu.org/archive/html/bug-inetutils/2025-12/msg00017.html