Lars Fischer

Short:
I had to rotate my OpenPGP-keys. The current key is now

63F831BAAAFEA6B63D9514E441D8FF5258F8FB4A

Get it from the usual keyservers.

Long:

I am switching from GnuPG to sequoia-pgp and at the same time I had two expired subkeys. A ``sq key rotate`` did not produce the results I intended (new subkeys) and adding two new subkey did not seem to be importable to thhunderbird. The easy way out was to generate a completely new key — also as a test to see if this one could be imported into thunderbird (it could and I simply made it my main key).

``sq`` has a very easily usable CLI and absolutely helpful ``--help``. Plus, it does not have https://gpg.fail sitting on its back. The switch is not going without a hitch because I now have to move my private MUA to something that is working with sequoia and notmuch.

I absolutely love that ``sq`` is giving you hints on further switches that could improve the output. It seems that you are never been left helplessly stranded.

So, kudos and thanks
@sequoiapgp@mastodon.social
I think I'll give it a try for a while.

Plus, did you know that the IMPACT CA that "my" students built a year ago is using the sequoia library?

It seems every military organisation has to do #stravaleaks at least once … These days it has been the french.

Maybe we should provide strava with the Nobel Peaceprice. They seem to make military operations much more risky. Maybe this leads to (significantly) less war.

https://www.lemonde.fr/international/article/2026/03/19/stravaleaks-le-porte-avions-charles-de-gaulle-localise-en-temps-reel-par-le-monde-grace-a-l-application-de-sport_6672445_3210.html

I am slow in adopting all the shiny new technologies. (I actually went "backwards" to vim somewhat 10 years ago, after having been forced to work in one of those big IDE-things, eclipse I think it has been. Even emacs seemed bloated afterwords, though I had long years of happy relation with the latter. No hard feelings there.)

Turns out that it's good I could not remember the name "openclawai" that has been recommended to me by a fascinated coding-person.

Today (well, yesterday. Remember "slow") moltbook featured in "this week in security". Some million of API-keys disclosed to the general interested public — as well as the nefarious ones too. So there is an example of an Ouroboros (that a phrase usable here? Make it one.): Vibe-coders (or -shellers) bitten by vibe-code platform for vibe-coding. Well accidents tend to happen, bad code happens too, let us just see the funny side of this and do not think about what could have happened if this kind of very much not-mature technology would already be adopted widely.

Instant Update: I just got word from the office next door about the fascinating efficiency of vibe-coding and how everybody is and should be doing it. O_o (Told you; "slow" 😉)

(source: https://www.wiz.io/blog/exposed-moltbook-database-reveals-millions-of-api-keys via: https://this.weekinsecurity.com/this-week-in-security-february-8-2026-edition/)

Wenn du mein Betriebssystem unter Kontrolle hast, wieso musst du mir das in einem PDF mitteilen? Ich fände es beeindruckender, wenn da einfach die klassische Erpressernachricht auf dem Bildschirm auftaucht. Ausserdem ist das PDF das du mir geschickt hast kaputt. ;-)

Not only students grow at this university. Its "applied", keep that in mind.

Put them in last week.

Temperatur im Büro heute 31°C.

Let me borrow from Bruce Schneier @Schneier_rss@burn.capital: ‘We don’t issue letters of marque on the high seas anymore; we shouldn’t do it in cyberspace.’ [1]

He has gotten struck by a sentence in the 2026 US Cyber Strategy (linked in [1]) which seems to imply that the White House (signed by DJT) is actually planning to somehow incentivize private companies to attack adversaries in the "cyberspace". (Sorry, I still cannot write the word "cyber" without flinching, I have Wieners "Cybernetics" in my bookshelf.) Which would (excuse the former digression, hope you are still following), as Schneier puts it, be "an incredibly dumb idea".

Incredibly dangerous as well, like handing everyone a gun, a blindfold and incentivizing they shot whenever they feel threatened or attacked from any direction. Cascades of hacks and hack-backs. Maybe the best thing would be if companies would outsource the "disruption of adversary networks" to the same hacker-for-hire, because they then might realize that they have contracts with both sides and hopefully just stop disrupting any of the two networks.

Plus, I assume, it would be illegal in most jurisdictions — including the current USA.

[1] https://www.schneier.com/blog/archives/2026/04/is-hackback-official-us-cybersecurity-strategy.html

Ongoing

Category Theory is cool and if only because you can abbreviate it as "Cat Theory".

Started re-reading "Category Theory for the Sciences" by David Spivak with a friend. Read the foreword for the first time and immediately got this nice quote from it:

“when we formalize our ideas, our understanding is clarified. [...]
And if we are ever to get to the point
that we can input our ideas into computers,
we will need to formalize these ideas first.”

Very much what I experienced dabbling in Haskell-Code and the reason why that felt very much elevating.

If you know him on mastodon, please drop me a pointer. (Best in the way of "Hi, I'm David, glad you like my books", because I own two of them and cherish them both. (Just found a missing closing-bracket in section reference. I'd like to improve the second edition, but that is such an unimportant mistake. I both hope and not hope to find some mistake important enough to write an email.)) )

[Here I added an extra bracket for you to take, should you become aware of this text.]

Wrote a very short tutorial on taskwarrior.
https://informatik.hs-bremerhaven.de/lafischer/tutorials/2026-02-11-taskwarrior.html

Quickly, I have to absolutely urgently to help the chair of the board of GÉANT, who inexplicably unexplained cannot access his geant-email and thus has to borrow a presidents(! no less) gmail-account, with something utterly urgent! !k! Europe, no, the world is at the brink of cyber-apocalypsis.

#scamoftheweek

Is this some insufficient elaborate scam for busy professors? You are out of luck, I have grading work to attend to. There is no other task on my schedule for today — because I will use any and every excuse to #procrastinate from grading exams.

Or is it just, that something found me which could be called "shotgun-whaling"? Because I'd like to start the day with creating some new and (arguably) funny terminology. It would make my day so much better to see such a thing make a small ripple through the fediverse. I am soooo much not phishing for boosts here! ;-)

Oh, look, the tea is empty, have to go and brew some new tea.

(The 'k' between the exclamation marks above becomes slightly more funny if you are typing with the neo2 layout.)

Nice, short read on vulnerabilities in two password managers. (Others seemingly have not been addressed.) Weaknesses like "missing authentication" might raise some hairs.

https://arstechnica.com/security/2026/02/password-managers-promise-that-they-cant-see-your-vaults-isnt-always-true/

Short commercial for the standard Unix password-manager https://www.passwordstore.org/ here. Main advantage in this context is that the actual software is simply combining trusted and tested tools and concepts: pgp, files, git, ssh, pinentry, various tools to further use pass in different applicatios , and not trying to "re-invent". That also has the advantage of the passwordsbeing accessible if the password-store software becomes unusable.

Furthermore it is easier to estimate the achieved level of security, e.g. https://gpg.fail/ (Prectical hint, sequoia-chameleon promises to provide a stand-in replacement for gnupg.)

Hamburg GI-Sicherheit. Leider einen Tag später. Workshops waren gestern.