Mastodawn

It was originally “have one joint and keep it well oiled”, but I guess it’s “have one joint and keep it well GREASEd” these days.

Adam Langley 6d ago

Filippo Valsorda 6d ago

In 2020, OpenSSL had a vulnerability in handling the signature_algorithms_cert extension. https://openssl-library.org/news/secadv/20200421.txt

Palo Alto apparently "solved" this in their IPS by blocking connections with "unknown" algs in signature_algorithms_cert.

Six years later, we can't add ML-DSA to signature_algorithms_cert in Go. signature_algorithms_cert is dead.

Sigh.

Thanks to @cks for diagnosing this. Sometimes it takes us months to figure out things like this.

https://github.com/golang/go/issues/79626#issuecomment-4754225610

Show thread

Adam Langley May 23

@rmondello One of these[1] on the desk, with all 250W cables so that I don't have to think about things at home.

When traveling, still very much the MINIX.

[1] https://www.anker.com/products/a2345-anker-prime-charger-250w-6-ports-ganprime?variant=43931956478102

Anker Prime Charger (250W, 6 Ports, GaNPrime)

Super Fast 250W Output: Experience the convenience of high-capacity charging with this 250W desktop charger, featuring four USB-C and two USB-A ports to po

Anker

Show thread

Adam Langley Apr 24

@neilmadden @filippo Filippo would have a much better sense of the demand (or not) for this in Go. I never implemented it because it seems like a bit of a trap and I don’t recall people shouting enough for it.

If you lose an encrypted private key, but it’s only encrypted with a human-set password, are you really not going to consider it compromised?

And if you have a way to transfer a random passphrase securely, can’t you just transfer the private key itself that way? They’re not big these days!

So yes: random passphrase > human-set here, but still a questionable facility in general.

Adam Langley Apr 1

Alex Kretzschmar Mar 31

Brutal.

When Microsoft acquired GitHub.

Adam Langley Mar 8

Recent podcast episodes that I particularly enjoyed, and that might be worth your time.

Deliberately, none of them are about current affairs. Not that you should be cut off from the world, but I need to measure my intake of it in times like this. (The second and last are more anchored in the current moment, so choose your own mixture as desired.)

* Ada Palmer on understanding the Renaissance: https://www.dwarkesh.com/p/ada-palmer
* Joe Weisenthal on literate and oral cultures: https://www.theringer.com/podcasts/plain-english-with-derek-thompson/2026/02/17/the-media-theory-that-explains-99-percent-of-everything
* Acquired on the history of Formula 1 racing: https://www.acquired.fm/episodes/formula-1 (It seems silly to link to an Acquired podcast; it seems like the most popular podcast in the world at the moment. But I'm still finding that people aren't aware of it so, if that includes you, here you go.)
* Hank Green on running an education company: https://podcasts.voxmedia.com/show/decoder-with-nilay-patel (I can't seem to link to a specific episode, but it was only a few weeks back).

Why Leonardo was a saboteur, Gutenberg went broke, and Florence was weird – Ada Palmer

Ambassador visiting Renaissance Florence: “Where am I? None of this has existed for a thousand years."

Dwarkesh Podcast

Adam Langley Mar 8

Filippo Valsorda Mar 8

Dustin Moody from NIST: “you don’t need more than 128 bits of symmetric keys for post-quantum security” #rwc2026

Say it louder, for the people in the back!

Show thread

Adam Langley Feb 8

@tynstar Indeed! There are likely services already which do this. (And I've used one in the past.) They'll be more polished and featureful. But the no account, no emails, exactly-what-you-need nature is nice for my basic use.

Adam Langley Feb 6

Since custom little utilities are now almost free for the technically-minded, I guess I value of ideas for them has increased.

In light of that, two things that have been making my life slightly better this week:

* A Chrome extension that lets you select any div on a page and then downloads the contents of that div (including images) as an EPUB for putting on an ereader.

* A job that runs on a little server that monitors my email and, based on a YAML file of regexps for sender, subject, etc, will notify me via Pushover if a matching email is received. (No polling, thanks to JMAP.)

Adam Langley Jan 27

Augie Ray Jan 26

I'm not saying the Trump administration is turning the US into a dystopian hellscape, but when the local newspaper needs to help you identify what toxic gas Federal agents are unleashing on citizens, I think it speaks for itself.