Viewing profile — soatok

(This is some_furry, I'm currently rate-limited. I thought this warranted a reply, so I switched to this account to break past the limit for a single comment.) > This statement is …

I strongly agree with you, but I have no confidence in my country's current elected representatives to ever do anything good, so our hands are tied until we vote them out.

If they won't pay for it, they can also kindly fuck off and not crawl my blog. Both are fine outcomes for me.

> Will the verification be automatic? Yes, and furthermore, there's already built-in support for ledger monitors to ensure the honest and integrity of their log. The whole point of…

> Signal's way to validate that a session isn't man-in-the-middle'd is the same as XMPP: You have to validate the session's fingerprint in real life, or over another secure channel…

The whole point of end-to-end encryption is that you shouldn't have to. The entire point of Sealed Sender and their use of zero-knowledge proofs for group membership is so the serv…

I wasn't present for the NIST crypto reading group, but I documented a lot of these in 2022, if you'd like a deeper dive into that problem space: https://soatok.blog/2022/12/29/wha…

> The issue with security researchers, as much as I admire them, is that their main focus is on breaking things and then berating people for having done it wrong. This is plain inc…

> I don't see many "cryptography experts" putting effort into improving developer documentation resources for libraries. This isn't a "documentation resources for libraries" proble…

Thanks, happy to help! > You seem to be posting from 2 different accounts: soatok and some_furry. Dunno if that’s on purpose, but in the off chance that it is not: Now you know. Wh…

> If a user has to call into your keyserver to get a key before they can start a conversation with a new friend, as you're the sole authority who can decrypt the Merkle tree entrie…

Thanks for the kind words. I wrote a previous deep dive into database cryptography, which talks about things like searchable encryption (which may offset some of the relevant ineff…

> Is the intention that E2EE have a separate, parallel account recovery mechanism with more difficult requirements? I'm not sure the wording here is helpful. Let's start with a sim…

> For sure more than a single-digit percentage of people have tried a Q&A bot by now. Tried is doing a lot of heavy lifting. https://meow.social/@crumbcake/113156927685392932 > Sho…

> The hype is around like content creation and AGI, which is a nothingburger. Right, which is why TFA specifically talks about "Generative AI".

> Yes, that is absolutely what I meant. > That doesn't mean that it operates at the specific level of bosons or the force of gravity, which is what I read your comment as suggestin…

> I didn't say that it belongs at the same level of abstraction, and no that isn't necessarily implied. The definition of fundamental is, in this context, best compared with this o…

> Nobody said consciousness is best described at the subatomic level next to bosons. Above: > Conscious awareness appears to be a fundamental aspect of the universe -- as fundament…

> And you haven't mentioned the moderation costs to Meta. What about my comment obligates me, in any way, to mention that? It seems like an odd thing to demand. What's going to hap…

> I always laugh when I see that "furry" is a category too choose server from on the official page. > Too bad there is no "hentai" that would be the cherry on the cake. It sounds l…

It does exactly what I've been describing! They provide AE, not AEAD. They feed an IV and ciphertext into HMAC. They don't feed additional authenticated data. If someone followed S…

I don't care about his opinions or takes, I care about the harm he inflicts by reinforcing the beliefs that undermine junior developers' confidence.

> His comment was a response to your post. Your post discouraged people from writing crypto, because they aren't qualified. This is where you were gatekeeping. Re-read the post car…

I don't have a personal political agenda here. I'd love for GNU cryptography to be better, but the first step in fixing problems is to acknowledge they exist in the first place. GN…