It finally happened. We finally got @lcamtuf to hang out with us for an hour, to discuss bugnarok, a.k.a. bugsment day, f.k.a. the bugpocalypse. securitycryptographywhatever.com/2026/06/14/f...

Facing the Vulnpocalypse With lcamtuf

We talk to Michał Zalewski (lcamtuf) about the vulnpocalypse and if we even need fuzzers anymore. This episode may be export controlled at a future date. Th...

securitycryptographywhatever.com

What in the everloving fuck are these people thinking? A fucking car has a 16 year age floor.

If I was participating in a cryptography standards group and said something that caused an academic cryptographer to vocally question their support of formal methods, I would immediately take a 3 year sabbatical from computers and go work at Whole Foods or something.

So this is perfect. connections.audio

Blake Colquitt claims Hacker News is hospitable to "race realism" (because of Curtis Yarvin). We share most of an opinion about Yarvin, but he is making up that claim about HN. HN is distinctively INHOSPITABLE to that stuff, far more so than Bsky. www.dontbeasucker.blog/p/the-butter...

The Butterflies in Your Stomach Are Planning a Coup

It only took 250 years for American elites to forget why they hated monarchy

dontbeasucker.blog

People meeting up at around 7PM at Kaiser Tiger on Ogden/Randolph for ChiSec, if you're bored and want to drink with nerds. No RSVPs, just show up.

Very much enjoying watching nerds attempt to cancel Olga Tokarczuk for acknowledging she used LLMs in her brainstorming process. Nobelslop!

(good article, I wish I could have clicked on the images to view them full size) I also made a markdown renderer that works exactly like I want, because I was unhappy with glow: github.com/llimllib/mdr...

I wrote a thing. This is not a love letter to Emacs, which is one of my more toxic and codependent relationships. sockpuppet.org/blog/2026/05...

Oh, ChiSec is tonight, bunch of security nerds hanging around at a bar, Kaiser Tiger on Randolph/Ogden, 7PM. No RSVPs, just show up, look for the table of nerds. Has been pretty well attended lately.

Skyr is the king of all dairy products, that is all.

Alex Gaynor on the "sufficiently smart compiler" of software security, the mythical actually-effective static analyzer: alexgaynor.net/2026/apr/13/...

This is a fucking incredibly great bug. Ask Claude to demonstrate it for you; it'll one-shot it. For ECC signatures (at least), WolfSSL thinks a 1-byte SHA2 hash is just as good as a 32-byte hash.

I wrote something: sockpuppet.org/blog/2026/03...

Yeah, so, I'm going to have more to say about this later, but, for now... yeah. securitycryptographywhatever.com/2026/03/25/a...

AI Finds Vulns You Can

Returning champion Nicholas Carlini comes back to talk about using Claude for vulnerability research, and the current vulnpocalypse. It’s all very high-brow ...

securitycryptographywhatever.com

Extremely psyched about two upcoming SCW guests, one of them this week. We've got very crunch vulnerability research and cryptography stuff coming.

Y'all, I've seen some shit, but I've never seen someone want *both* DNSSEC ceremonies *and* the CA/B Forum before.

Nicholas Carlini at [un]prompted. If you know Carlini, you know this is a startling claim.

None of you are giving me enough credit for not participating on the TLS working group mailing list. You're welcome. Everything I don't do, I don't do it for you.

Annals of things people have actually written down for other people to read: "No one trusts NIST. But people do trust the IETF."

People who hope to apply Daniel Bernstein's rules-lawyering tactics at IETF, which were honed in the DNS WGs (where he was probably in the right), would do well to remember that those tactics have consistently failed. They've merely won him standing to complain about the IETF.

There's only one correct way forward for handling the introduction of MLKEM into TLS, and, indeed, all future tls-wg cryptography debates, and it's this proposal: snkth.com/add-crypto/

Given how i am only a) a beneficiary of air travel (thanks for all the miles so far) b) A non-avionics-expert reader of the EUROCAE WG-128 RTCA/DO-254 drafts c) A spectator usually attending this type of debate with popcorn I hope my comments are useful...

"Auchentoshan" is inarguably the best distillery name.

Very fun: if you have the dictionary of embeddings Semantle uses, solving it is a trivial linear algebra problem: they're giving you the cosine similarity back on every guess, so you can filter out most of the vocabulary on a single guess. victoriaritvo.com/blog/semantl...

For a lot of years I was in the habit of criticizing cryptography designs that used asymmetric constructions because RSA is much more complicated and hard to get right than symmetric crypto. But the real problem is that it's against the law to authenticate an RSA key.

Seriously, every paper with Backendal as an author is a banger

"presenting a cornucopia of practical attacks". These are my favorite words ever to have occurred in a cryptography paper.

I think even calling it Chess is being charitable; many days I think it's closer to the board game Concentration.