wrote a little about the (now old news) security events of last week

Go@golang.org · 2w ago

“Our Response To The eMudhra Key Disclosure Incident” by Roland Shoemaker, on behalf of the Go Security team — https://go.dev/blog/emudhra-incident #golang

My mind has been fully boggled since ~yesterday afternoon and it's lovely to have the world catch up.

You should take this update. bsky.app/profile/gola...

Go@golang.org · 3w ago

👩🏽‍🔬 Go 1.27.3 and 1.26.10 are released! 🔐 Security: Includes 1 security fixes to the standard library. 🗣 Announcement: https://groups.google.com/g/golang-announce/c/66pojueaQek/m/tmWX2Pq9AgAJ 📦 Download: https://go.dev/dl/#go1.27.3 #golang

👩🏽‍🔬 Go 1.27.3 and 1.26.10 are released! 🔐 Security: Includes 1 security fixes to the standard library. 🗣 Announcement: https://groups.google.com/g/golang-announce/c/66pojueaQek/m/tmWX2Pq9AgAJ 📦 Download: https://go.dev/dl/#go1.27.3 #golang

This past Weds at #rustconf, Joe Birr-Pixton and Daniel McCarney shared an update on the Rustls project 10 years in! Don't miss this write-up from Joe that captures some of what they covered onstage. Congrats on such a long run of this important project, Rustls! rustfoundation.org/media/guest-...

📢 Session: "A Decade of Rustls": update from maintainers @jbp.io & Daniel McCarney at #rustconf! 10 years in, what's next for one of Rust's most widely used TLS libs? 🎟️: rustconf.com/register?utm_source=rustconf_x&utm_medium=social&utm_campaign=week_july20 rustconf2026.sched.com/event/2KHyL/...

I don't get why anybody is listening to Jacob Applebaum. My cat has about the same expertise in cryptography, and has never been credibly accused of sexual abuse. She's also a lot cuter.

We're making good progress on upki, our collaboration with the rustls project to bring browser-grade web PKI capabilities to low level system utilities. #Canonical made a PPA available so you can try out upki in #Ubuntu. Give it a go and let us know! discourse.ubuntu.com/t/try-the-up...

@jbp.io and I will be presenting on our upki project to make TLS certificate verification more secure for non-browser Linux apps.

Canonical Ubuntu@ubuntu.ubuntu.social.ap.brid.gy · 5mo ago

The countdown is on! We’re getting ready to showcase the latest, innovative projects in open source, presented by a great lineup of speakers. Register now to watch the livestream from anywhere in the world. https://ubuntu.com/summit

At #rustweek I'll have new stickers celebrating a decade of rustls. First commit was ten years ago tomorrow

If you'd like, you can buy rebrands and listed OEs from us. However, you don't have to! Our cert has one of the broadest list of tested OEs of the industry, and you can just use it with stock Go 1.24+ and GOFIPS140=v1.0.0, courtesy of Geomys. The point was removing this roadblock to Go adoption.

Geomys FIPS 140-3 Services

Geomys handles the CMVP validation of the FIPS 140-3 Go Cryptographic Module, and contributes the module to the upstream Go project, for the benefit of the Go community.

geomys.org

A bit over two years after starting to work on it... Go is officially FIPS 140-3 certified 💥 csrc.nist.gov/projects/cry... I am pretty confident Go is now one of the most—if not the most—seamless and complete FIPS 140-3 compliance solutions... with a single env var, out of the box.

New Blog post: "Multiple things can be true at the same time" - frederikbraun.de/feels-and-ll... Dear reader, I am sure you have read a lot of blog posts about AI in the past weeks or months. This is my post.…

I wrote a blog post for the Alpha Omega Foundation on the work I did to surface RustSec advisories on crates.io: alpha-omega.dev/blog/surfaci...

crates.io: Rust Package Registry

crates.io

@filippo.abyssdomain.expert plugs Wycheproof test vectors github.com/C2SP/wychepr... #realworldcrypto

did something very silly, may have some at gophercon this year if you ever sent us a vulnerability report or contributed to Go crypto (or are just nice to me) thanks to @ljamesart.bsky.social who did the great art!

With the @openuk.bsky.social Awards coming up, we’re excited that Rustls — a memory-safe TLS library — is shortlisted in two categories, and Creator Joe Birr-Pixton is also recognized individually. The Rust Foundation is proud to support Rustls through the Rust Innovation Lab 🧡

Rustls Shortlisted for Two 2025 OpenUK Awards - The Rust Foundation

The Rust Foundation is delighted to congratulate Rustls for being shortlisted in the Open Source Software and Security categories of the OpenUK Awards 2025 — and Joe Birr-Pixton, Rustls Creator, for…

rustfoundation.org

In August I delivered my traditional Go Cryptography State of the Union talk at @gophercon.com in New York. It goes into everything at the intersection of Go and cryptography from the last year. (Also, bragging t-shirts!) Watch the video or read the transcript of my performance review!

The 2025 Go Cryptography State of the Union

I delivered my traditional Go Cryptography State of the Union talk at GopherCon US 2025 in New York. It goes into everything that happened at the intersection of Go and cryptography over the last…

words.filippo.io

Maintaining #Rustls isn’t just code — it’s choices. Dirkjan shared how OSS maintainers balance safety vs. niche flexibility and why API instability or incompatibility can ripple across the ecosystem. Full story at netstack.fm/#episode-7

Netstack.FM — A Podcast About Networking and Rust

Interviews, monologues, and deep dives into Rust and modern networking systems.

netstack.fm

We have a little blog post about this rustls.dev/blog/2025-09...

The Rust Foundation@rustfoundation.org · last yr.

LIVE at #rustconf: The Rust Foundation has launched its new "Rust Innovation Lab" with Rustls, a leading TLS library, as the inaugural hosted project! The RIL provides comprehensive support for funded OSS projects, ensuring sustainable & community-led growth. rustfoundation.org/media/rust-f...

we lived

PowerDNS Recursor 5.3.0 has a nice note in the changelog: > The embedded webserver used to display the status page and process REST API calls has been rewritten in Rust and now supports multiple listen addresses and TLS. The new code is powered by Hyper+Rustls+Ring 🦀 🔒 (h/t Stefan Schmidt)

TIL the B root servers have deployed experimental DoT support for TLS on the recursor -> auth. server leg: b.root-servers.org/research/tls...

TIL that the ITU has an annual "X.509 Day", wheeee www.itu.int/md/T25-TSB-C...

We announced the new native Go FIPS 140-3 mode today! FIPS 140, like it or not, is often a requirement, and I was increasingly sad about large deployments replacing the Go crypto packages with non-memory safe cgo bindings. Go is now one of the easiest and most secure ways to build under FIPS 140.

The FIPS 140-3 Go Cryptographic Module

Go now has a built-in, native FIPS 140-3 compliant mode.

go.dev

Today we released rustls 0.23.29 crates.io/crates/rustl... -- highlights are better error reporting for unsupported signature algorithms in certificates, and quite a few performance improvements (via a set of changes that started almost 2 years ago!)

crates.io: Rust Package Registry

crates.io

Pretty excited about the release of instant-acme 0.8, with lots of work from @cpu.xkeyscore.club (who joined as a maintainer) on ARI, profiles, integration testing and a much improved API. github.com/djc/instant-...

Release 0.8.0 · djc/instant-acme

The 0.8 release contains substantial changes to make the API more modular. It integrates full support for ACME Renewal Information (ARI, recently standardized as RFC 9773). Since the 0.7.2 release,...

github.com

Nerd-sniped by bagder into looking at how rustls-ffi stacks up against OpenSSL on memory allocations/peak heap usage when plugged in as a curl vTLS backend. Headlines: * with rustls-ffi 0.15.0: 2,176 allocations. peak heap of 394kB. * with openssl 3.4.1: 308,132 allocations (!). peak heap of 2.1MB

daniel:// stenberg://@bagder.mastodon.social.ap.brid.gy · last yr.

1.Download https://curl.se using #curl built to use OpenSSL 2. count number of allocations made with heaptrack 3. pause for gasping 4. double-check that curl only does 134 allocs itself, independently of the downloaded size 5. check the heaptrack number again 54,000 hm

You love to see it.

Track two new CVE's of ogsudo by squell · Pull Request #1173 · trifectatechfoundation/sudo-rs

Two new CVE's were disclosed yesterday in ogsudo which do not apply to sudo-rs since they pertain to functionality we chose not to support.

github.com

I don't think they post here, but excited to be talking about what the Go Security team does, and why (hopefully) you don't hear much about us, at GopherCon UK in August.