Tootfinder

Opt-in global Mastodon full text search. Join the index!

@qbi@freie-re.de
2026-02-19 07:29:44

Reuse,
gut für die Fischerei
schlecht in der Kryptografie
blog.trailofbits.com/2026/02/1

Carelessness versus craftsmanship in cryptography
Two popular AES libraries (aes-js and pyaes) provide dangerous default IVs that lead to key/IV reuse vulnerabilities affecting thousands of projects. One maintainer dismissed the issue, while strongSwan’s maintainer exemplified proper security response by comprehensively fixing the vulnerability in their VPN management tool.

@mgorny@social.treehouse.systems
2026-05-05 05:25:48

#Python #cryptography library (yes, the one that criticizes everything and everyone) is now vibecoded. Our future is truly bright!
Noticed because apparently "Claude" wrote a test that OOM-ed my system. But hey, #RustLang protects against memory errors, so it's fine to vibecode your security critical components.
#security #AI #LLM #NoAI #NoLLM

@mgorny@social.treehouse.systems
2026-04-08 13:30:38

Fun post pointed out by Werner Koch on the GPG "post-quantum defaults" thread:
#cryptography #QuantumCryptography #security

@neverpanic@chaos.social
2026-02-16 16:23:39

RE: #PQC