Mike Ounsworth in "Why have the PQC standards taken so long? Bottlenecks, bickering, and building momentum":
"30 minutes after the standard was published @sophieschmieg was like: that was NOT what I meant, I meant this thing on line 6, external mu, that preserves the security properties"
Do you need an excuse to attend the OpenSSL Conference? You get to claim your copy of the Post-Quantum Trails boardgame, sponsored by the OpenSSL Foundation!
https://openssl.foundation/news/post-quantum-trails-board-game
#OpenSSL has gotten big, this is just the staff of the Corporation, and there's people working for the Foundation, too.
David Hook on why many of these crypto projects started in Australia: "export control laws only affected tangible items", "if I had a copy of BouncyCastle on CD when getting on a flight, I would have missed that flight"
"You started BouncyCastle when OpenSSL already existed. Why write another cryptography library?"
David Hook: "Oh, why not."
"For about two years I got hate mail for giving it a stupid name."
"3.0 was not a particularly lucky release, there were lots of performance problems to fix"
-- @mold
I guess you could say that, yeah. 😂
If you're not interested in a bunch of posts on OpenSSL coming up, you might want to mute the OpenSSL or OpenSSLCon26 hashtag for the next four days.
Eric A. Young (OpenSSL's co-founder, the "eay" in SSLEay), Matt Caswell (President of the OpenSSL Foundation), and Anton Arapov (OpenSSL Corporation) on stage.
That's many years of experience in #OpenSSL in one place.
The slop pause music is a bit cringe, though.
Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.
The username is admin and the password changes every day automatically to.. the current date.
Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.
I read some post about how Mastodon consists primarily of German-speaking creatures talking in English. I'm gonna do a poll, need to test that. Boosts highy appreciated!
So, do you speak German?
Anthropic launched OSS Scanner yesterday: free, periodic vulnerability scans for critical open-source projects, generated by their strongest models and sent to maintainers without human review in between. I am quoted in the announcement.
Eighteen months ago the AI-generated reports reaching the OpenSSL Security Team were appalling: high volume, little substance. Today, by our own numbers, 75 percent of external vulnerability reports to the OpenSSL Library show strong AI authorship. Over the last two years they were accepted as security issues at 22 percent against 20 percent for reports written by people, and rejected as not-a-bug less often, 26 percent against 38 percent. The reports we received from Anthropic, raw model output included, were as good and sometimes better than what we get from people.
The number of reports written by people has not left its historical range; the growth is AI. Verification is still done by people. Every report, whatever wrote it, is triaged by the OpenSSL Security Team as a security issue, a bug, or not a bug before anything is fixed. When it comes with a working exploit, that review is immediate. We had to grow the team to keep up.
Anthropic says its models found 29,000 candidate vulnerabilities in six months and humans could review 6,000. The constraint now is the number of findings nobody has reviewed and where they end up. Findings that reach the maintainer get fixed once, upstream, for everyone. Findings that stay with whoever found them get patched in private forks. The OpenSSL Library will enroll in OSS Scanner for that reason.
'It Is Done. Hail Satan:' City Immediately Regrets New Religious Liberty Law That Allows Prayer at City Council Meeting
Iowa city council debates proper time in meeting agenda to "undo the curse that was just put on our city."RE: https://infosec.exchange/@SteamDB/117406473069923636
Get this, it's great. Weird, but great.
RE: https://23.social/@linuzifer/117404909658967961
We've come full circle. I really don't know whether to love or hate this.
"The people holding up the internet"
A good-looking but somewhat depressing exposé about the people holding up current digital infrastructure as a hobby.
ah damn, RIP Margaret Hamilton.
she took safety-critical software engineering seriously, and got people to the moon and back.
news.mit.edu/2026/margare...
MIKE is finally here and I am so excited! 80B public keys! 4.86ms secret generation! A proper NIKE! Security is just the isogeny problem! Short and simple constant-time implementation in both C and rust! This has to be the curve25519 of its generation.
This shall be interesting to watch:
"an open-source, clean-room reimplementation of Adobe Photoshop, rebuilt in pure Rust."
https://github.com/storytold/photocraft
The outcome of this experiment is beneficial for the world either way. The LLM copyright question pertaining to the clean-room myth will have to be addressed directly. With Adobe on the other side of the table - an adversary with the motive and means to do so thoroughly - there will be only winners, no matter how this plays out. 🍿
