Virebent

Moved servers, and every Gemini capsule started screaming "untrusted server." Why: my old server (agate) only does self-signed TOFU certs, no CA chain and clients had the old fingerprints pinned, so they rejected the new ones too. Fix: patched gmnisrv to send a full Let's Encrypt chain, forced TLS 1.3, and fixed a crash where a big chain overflowed the handshake buffer (a free DoS on a public port). Renewals auto-reload now.

Patched fork: https://git.virebent.art/virebent/gmnisrv

Live, CA-verified, TLS 1.3:

• gemini://contact.virebent.art
• gemini://virebent.art
• gemini://archives.virebent.art
• gemini://n5ry24fweklbn562o7fnyefanygtwxlgi7aevn26huuxqlsftxy5ljqd.onion (self-signed —

If your client grumbles once about a changed cert, accept it. That's TOFU.

Best regards and have fun !

A public project should not be credible only because it appears online.

This is why I am using ProofBundle for the projects I publish and discuss publicly, including the ones I present here on LinkedIn.

ProofBundle creates a portable cryptographic proof for a project snapshot.

It takes the files, builds a deterministic SHA-256 manifest, reduces the entries into a Merkle tree, and produces one Merkle root for the whole project state.

Then that root is bound to a signed author/custody claim.

ProofBundle can also use OpenTimestamps: the Merkle root and manifest hash are timestamped and anchored to public blockchains, without uploading the original project and without putting the contents on-chain.

So the proof has three layers:

• integrity: SHA-256 hashes, manifest, and Merkle root
• identity/custody: Ed25519 or OpenPGP signature
• time evidence: OpenTimestamps blockchain anchoring

For signing, ProofBundle supports a default Ed25519 mode: modern, compact, and easy to verify.

It can also use a detached OpenPGP signature, including OpenPGP keys based on Ed25519. And for stronger key custody, OpenPGP signing can optionally be backed by a YubiKey, so the private signing key stays hardware-backed and non-exportable.

This is not copyright registration and it is not a legal shortcut.

It is technical evidence that:

• this exact project state existed
• these files matched this manifest
• this Merkle root represented the snapshot
• this key signed the claim
• the timestamp evidence was

anchored through OpenTimestamps

• the proof can be verified independently

Full technical note: https://www.gabrielesalati.eu/blog/proofbundle-verifiable-project-integrity.html

#ProofBundle #OpenTimestamps #Blockchain #OpenPGP #Ed25519 #MerkleTree #YubiKey #CyberSecurity #SoftwareEngineering #OpenSource

I’ve just deployed N2Usenet, a standalone web gateway for posting to Usenet over Nym instead of the older Tor-based posting path. The idea is simple: the site lets you create a persistent pseudonymous identity directly in the browser. It generates an Ed25519 keypair locally, so the secret key never has to leave your device. From that identity, the public key is used together with the chosen username and email to derive a deterministic identicon, which is then embedded in the post through the classic Face: header. The result is a recognizable visual identity for Usenet posts, backed by a real signing key instead of just a display name. Each message is signed in the browser, and the post carries the related identity headers, including the public key, signature, and Face: header. On the transport side, the server relays the submission through Nym to the Mail2News gateway, so this path replaces the old Tor-oriented relay model for this service. It also keeps the usual anti-spam friction with Hashcash, and the current version clears the identity and message input from browser memory after successful delivery. If you want to try it, it’s here: https://n2usenet.virebent.art