Please welcome Guile Hoot in Debian #guile https://tracker.debian.org/pkg/guile-hoot
Remote
Simon Josefsson
@jas@fosstodon.org
mastodon 4.7.3252 Followers
398 Following
26 Posts
Joined September 22, 2018
Email:
simon@josefsson.org
OpenPGP:
B1D2 BD13 75BE CB78 4CF4 F8C4 D73C F638 C53C 06BE
Guile-GnuTLS v5.0.2 #guile https://lists.gnupg.org/pipermail/gnutls-help/2026-June/004930.html
”Exploiting ML-DSA bugs” - graphing risks with ML-DSA vs Ed25519+ML-DSA. https://cr.yp.to/papers/mldsa-20260601.pdf
Reproducible Guix Container Images #guix #containers #docker #podman #reproduciblebuilds https://blog.josefsson.org/2025/12/07/reproducible-guix-container-images/
Interested in SSH and Post-Quantum Crypto? Come to the #PQCSA workshop on Friday afternoon before #FOSDEM and hear my thoughts on the topic! https://www.esat.kuleuven.be/cosic/events/pqcsa-workshop-pqc-migration/
Replying to
Slides now up: https://josefsson.org/talks/fosdem-guix-container-images.pdf
The project source code: https://gitlab.com/debdistutils/guix/container
Docker Hub: https://hub.docker.com/r/jas4711/guix
Enjoy and happy hacking ☀️
Please welcome age-plugin-tpm to Debian! @Foxboron@chaos.social https://tracker.debian.org/pkg/age-plugin-tpm
Contrary opinion: go.sum is a generated non-source file and should not be stored in any git repository.
Replying to
@kpcyrd@chaos.social @djc@hachyderm.io Another concern is the Rust to C conversion, that could introduce fun stuff. Reading the 10+kloc https://github.com/openssh/openssh-portable/blob/master/libcrux_mlkem768_sha3.h is not pleasant. Generated by https://github.com/AeneasVerif/eurydice
Replying to
Finally video is available too: https://video.fosdem.org/2026/ub4136/ZELSB8-guix-containers.av1.webm It seems video subtitle texts were automagically created by the FOSDEM video team, and it is wonderful to see that it s/Guix/geeks/ all over. https://video.fosdem.org/2026/ub4136/ZELSB8-guix-containers.vtt
“Monitors 36 window.__oai_so_* properties tracking keystroke timing, mouse velocity, scroll patterns, idle time, and paste events. A behavioral biometric layer running underneath the fingerprint.” - how about saying that more clearly: Cloudflare installs a key logger in your ChatGPT browser session. Keystroke timing has been used to discover password, longer texts would be more predictable and easier to reconstruct. https://www.buchodi.com/chatgpt-wont-let-you-type-until-cloudflare-reads-your-react-state-i-decrypted-the-program-that-does-it/
Replying to
@civodul@toot.aquilenet.fr @djc@hachyderm.io @kpcyrd@chaos.social That would be OpenSSH, although I suspect modern OpenSSL may include similar stuff. Generated code like this is more common than most would want to admit. Debian sometime rebuild things, but in practice rely on upstreams being aligned on that. Debian include this generated file verbatim. Another concern is that ML-KEM is used under a patent license. My perception is that people are tired of caring about free software philosophy.
Great talk from @bunnie@social.treehouse.systems about the hardware supply-chain as a threat model in https://media.ccc.de/v/38c3-iris-non-destructive-inspection-of-silicon which is similar to my thinking about security dongle safety in https://blog.josefsson.org/2023/04/27/a-security-device-threat-model-the-substitution-attack/ - so I “had” to buy a couple of Baochip-1x and you should consider sponsoring that too! https://www.crowdsupply.com/baochip/dabao
”Reports of Telnet’s Death Have Been Greatly Exaggerated” https://www.terracenetworks.com/blog/2026-02-11-telnet-routing
Anubis, haphash... did people forget the '“Proof-of-Work” Proves Not to Work' paper? OTOH I still use X-Hashcash in my e-mails. https://www.cl.cam.ac.uk/~rnc1/proofwork2.pdf
Replying to
@cbaines Yay! Would this be useful to package for Debian? A git tag for v0.0 (or v1.0 :)) would be great
Replying to
@andrewnez Yay! I started the process to get this into Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1134655
Replying to
@hko@floss.social I don’t read Werner’s email as he wants to implement the v6 RFC, but just those curves?
Replying to
@cbaines@gts.hotaircat.net Great! There is tentative Debian package here now: https://salsa.debian.org/debian/guile-knots/-/jobs/9292458 -- I noticed a couple of nits in the code (confusing license headers, missing 'unit-test' module, lack of texinfo manual building) that I will report once your forgejo-instance permit user signup (or the codeberg login button works, now it just gives an internal error).
Replying to
@andrewg@mastodon.ie @hko@floss.social Interesting, I wonder if that effort will rub people in the right way to implement LibrePGP support? The community will be better off with more interop.
Replying to
@novacustom@mastodon.online You have a pre-order here! Please try to avoid MediaTek WiFi which commonly seems to be paired with AMD in laptops for some reason. Any chance AMD could support deep sleep mode with the ath9k cards? I recall some concern about ath9k and sleep mode on NV5x (although I have never noticed any problem on my NV56). That would be my preferred wifi card.
Boosted by @jwz@mastodon.social
Replying to
@jwz@mastodon.social @leah@blahaj.social Your quote from 2016 reads like it was written today. #debian #llm ”I guess you want Debian to be the kind of operation that uses the work of others while blatantly and explicitly ignoring the wishes of the person who *did the actual creative work*.” https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=819703#168