Soatok Dreamseeker

He/him. Gay/demi dhole (Cuon Alpinus)

Blogger, programmer, security engineer, cryptography nerd. 30+

Too spicy for Twitter (banned with all the prominent journalists on 2022-12-16)

I don't represent any company, individual, or community.

Pronouns: he/him
Fursona: Dhole
Orientation: Demi/Gay
Website: https://soatok.blog

Public Key

npub1wfp0azvqh9n27j7zgnej54cr9xjs5x2efztwzurjdpj34ea5vw9qdvw2m9

NIP-05 Address

soatok_at_furry.engineer@momostr.pink

Profile Code

nprofile1qqs8ysh73xqtje40f0pyfue22upjnfg2r9v539hpwpexseg6u76x8zs7lsmta

Author Public Key

npub1wfp0azvqh9n27j7zgnej54cr9xjs5x2efztwzurjdpj34ea5vw9qdvw2m9

Show more details

Last Notes

2024-08-14 17:18:42

If I make a mistake, just let me know and I'll correct it, because I care about technical accuracy a lot!
But if you want me to self-censor at your whims?
lol, lmao, get fucked

2024-07-09 17:50:06

Think of Oblivion NPC dialog.
"Not now, not later, not ever."
If that's not a fucking option for your consent modal, then you aren't actually requesting user consent properly.

2024-07-08 16:17:28

To address the haters:
*haters = NULL;

2024-07-02 17:28:52

My Furry Blog is NOT an Opportunity to Develop Your Brand
A common narrative on discussion boards like Hacker News is that my inclusion of my fursona on my technical blog posts somehow makes them unsuitable for consumption in a business setting. (This claim is made despite the fact that I've never posted pornographic art on this blog.) Well, Internet marketers must have missed that memo! They keep contacting me through various channels to try to pay me to publish…
http://soatok.blog/2024/07/02/my-furry-blog-is-not-an-opportunity-to-develop-your-brand/

2024-07-01 18:14:11

- reply

"Um akshually Mr. Dreamseeker, PROTIP is an old 4chan meme which is historically associated with-"
If that's an impulse you frequently experience, let me stop you there.
Have you made anyone laugh today? What about a smile?
When was the last time you brightened up the day of someone in your life?
That is where your energy should be spent. Not on doing what you were about to do.

2024-07-01 18:08:15

PROTIP: That a joke references a bad idea is not an endorsement of said bad idea
Holy fucking shit people

2024-07-01 13:56:05

Companies on July 1st be like #meme #pridemonth
https://furry.engineer/system/media_attachments/files/112/711/571/268/333/713/original/b43b2ae460ab19ee.mp4

2024-06-29 05:49:29

Sex between three people is called a threesome.
Sex between four people is called a foursome.
It logically follows that "you look handsome" is actually a sick burn.

2024-06-28 14:52:42

The group noun for queer cryptographers is a Rainbow Table.
https://cryptography.lgbt

2024-06-26 10:03:14

I'm convinced that some religious movements are just a cover for some deeply obfuscated kinks
Calvinism? Okay bud

2024-06-26 09:10:36

One reason why I persist in encouraging other furries to start blogs:
Y'all have much more interesting lives than I do, and have such rich experiences to share with the world, even if you don't realize it.
The reason folks like my writing isn't because I'm particularly interesting or skilled, it's because I've realized my potential.
My blog is what Peak Soatok looks like.
Most of my day is spent looking at or writing code, spending time at home, and producing absolutely nothing of *artistic* value for the world to enjoy.
When I do write something, it's usually at 3 AM when I can't sleep.

2024-06-19 05:19:09

Wait a minute. The furry fandom has been having exponential growth for years?
...
What are the damn rabbit furries up to?

2024-06-18 12:43:07

Life would be so much happier if more people had the humility to recognize that expertise isn't a single hierarchy of intellect but rather a random walk in a hyperdimensional space that makes fractals look simple in contrast.

2024-06-16 19:54:47

Wow, some complete fucking stranger is replying to me demanding I use Fedi their way
Lol no

2024-06-13 19:35:43

There are but two categories for chat:
General
Specific

2024-06-13 13:05:35

There ought to be a supermarket for pseudointellectuals
We can call it Dunning Kroger

2024-06-13 10:02:16

- reply

Believe it or not, there is still plenty of interesting and exciting work to talk about that doesn't involve LLMs.
Cryptographers contributing to the IETF is working to standardize FROST, a two-round threshold signature algorithm based on Schnorr proofs, which is backwards compatible with Ed25519.
This means it will soon be possible to generate Ed25519 signatures from, for example, 4-of-7 shares held by independent parties. And the verifier doesn't need to do anything different; it's just an Ed25519 signature to them.
That's cool as fuck.
There's little-to-no hype about it.

2024-06-13 09:54:30

- reply

At the end of the day, the only people who win this game are private equity firms whose primary goal is to extract rent from the properties they acquire.
That's the curtain call for whatever you're building with this mindset.

2024-06-13 09:52:09

- reply

Does your company chase the latest hype cycles instead of focusing on fundamentals?
Then I don't trust you.
You will sell your users out for a Klondike bar and your staff will jump ship rather than roll up their sleeves when the going gets tough. That's the culture you are cultivating.

2024-06-13 09:48:54

- reply

Tell me about your Boring Technology that gets the job done and gets out of your user's way.
Tell me how you made your app or service easy to use and hard to misuse.
Tell me how you're encoding an understanding of the importance of consent into your architecture.
Tell me how you're treating your employees better than your competitors are treating theirs.

2024-06-13 09:46:16

As someone who works in tech, I'm honestly tired of hearing about the same few topics from the same companies:
1. Layoffs
2. Return to office (see #1)
3. Record-breaking profits
4. Press releases about large language models
Shut up shut up shut the FUCK up

2024-06-12 14:46:14

- reply

Elevator pitch: Choose your own adventure, but with GitHub forks and pull requests.

2024-06-12 14:45:27

Me, having been poisoned by years of working in tech:
"Do I really want to write a fictional story, or would I rather just write a Wiki about the story that I'm imagining?"
"Wait, what if we made that a new literary genre where people wrote wikis about things that don't otherwise exist?"
....
"Did I just reinvent the SCP foundation?"

2024-06-11 13:52:30

HN users: "how DARE you put furry art on this technical blog post?! how am I supposed to use it to advance my own career? my boss will be livid if he sees me looking at PORN on the clock"
Their boss on LinkedIn: "so anyway I was reading Soatok's blog and have some thoughts about the latest post"

2024-06-07 21:07:13

I was recently reminded of this
https://www.youtube.com/watch?v=YQ_xWvX1n9g

2024-06-06 05:38:03

Towards Federated Key Transparency
In late 2022, I blogged about the work needed to develop a specification for end-to-end encryption for the fediverse. I sketched out some of the key management components on GitHub, and then the public work abruptly stalled. A few of you have wondered what's the deal with that. This post covers why this effort stalled, what I'm proposing we do next.
http://soatok.blog/2024/06/06/towards-federated-key-transparency/

2024-05-29 16:51:38

Experiment you can participate in too if you'd like:
Instead of posting duplicate content on Twitter or BlueSky, post everything on Fedi first, then just paste links to your Fedi post on those platforms.
When people reply, copy a link to their tweet and reply to your Fedi post, then reply to them on Twitter with a link to your Fedi reply.
Expose the people you want to interact with to this platform so much that they are likely to decide for thenselves to sign up.
If successful, we can probably shift some of the better Twitter users to Fedi. And they'll feel welcomed and engaged.
Win goddamn win.

2024-05-28 21:28:54

- reply

in b4
"And then I shot him, Your Honor."

2024-05-28 21:27:57

Me, still recovering from a 30 hour return flight from Spain:
"Now would be a perfect time to roll my own crypto!"

2024-05-23 11:06:06

Gaming on Linux discourse be like
"It's Linux's fault. Do better, FOSS!"
Gaming on Linux in practice be like:
https://www.protondb.com/app/1085660

2024-05-20 20:45:52

https://furry.engineer/system/media_attachments/files/112/475/365/643/257/996/original/cb62309bd3f52d66.jpg

2024-05-17 16:49:43

- reply

Nice!
If I found an exploitable implementation issue (like I did with Matrix earlier this week), I would of course report it privately. But my previous job conditioned me to never look at code on Fridays. ;P

2024-05-17 16:44:10

- reply

I like ToB. Lots of great people there.
If you have a bigger audit scheduled with them, I'm happy to withhold further criticism until they've had a chance to look at it. Odds are, they'll find more than I will just casually looking at it.
(Also I don't have Haskell chops)

2024-05-17 16:41:23

- reply

Also, in a general sense, I'm pretty sure pairwise ratchets is exactly the setup for an Invisible Salamanders style attack.
Alice -> Bob: Key1, P1
Alice -> Charlie: Key2, P2
Same C, T can be sent to both parties
But I haven't actually looked at your code, just critiquing your Markdown docs

2024-05-17 16:38:11

- reply

If you don't want me to publish my criticisms of your designs, tell your users not to ask furries for their opinions of said designs 😂

2024-05-17 16:37:08

- reply

That said, reporting issues in a public forum does not hurt anyone's credibility.
"Full disclosure is a damned good idea." - Bruce Schneier, Cryptographer
https://www.schneier.com/essays/archives/2007/01/schneier_full_disclo.html

2024-05-17 16:36:18

- reply

I'm not here to report a vulnerability. I was asked for my opinion, and I said I don't like your design.
One specific criticism is that you're using GCM but do not have any sort of Key Commitment in your protocol. That's not a vulnerability, to my knowledge.

2024-05-17 16:31:08

- reply

My complaint with Curve448 is that most things don't use it, so implementations are less reviewed.
The primary reason to select 448 over 25519 is a "biggest rock is best rock" approach to cryptography parameters. It doesn't help in any realistic scenario, nor against quantum attackers at all.

2024-05-17 16:27:25

- reply

Oct 11 - 14 is 3 days
https://furry.engineer/system/media_attachments/files/112/457/366/763/166/054/original/6539d531cfdb1a2f.jpg

2024-05-17 16:25:49

- reply

AES-GCM is.
If you're in a situation where you can have multiple keys (i.e. group messaging), you can send two plaintexts that encrypt to the same (ciphertext, tag).
https://github.com/soatok/gcm-exploit

2024-05-17 15:36:11

- reply

This needs a professional audit.
SimpleX was reviewed for three days by two people I respect in late 2022.
https://github.com/trailofbits/publications/blob/master/reviews/SimpleXChat.pdf
However, that is way too short a timeframe for something as important as E2EE.

2024-05-17 15:30:37

- reply

"Yeah, I'll have, uh... The SIgnal Double Ratchet. But with Curve448! And I'll use AES-GCM instead of CBC+HMAC."
"Daring today, aren't we?"

2024-05-17 15:29:35

- reply

Like, there is no reason for this mess: https://github.com/simplex-chat/simplexmq/blob/master/protocol/overview-tjr.md#encryption-primitives-used

2024-05-17 15:22:39

- reply

I don't see how SimpleX (which is anything BUT simple) mitigates Invisible Salamanders, given their reliance on AES-GCM.
Also, I don't see why they use Ed448 at all.

2024-05-16 19:23:01

- reply

Found and disclosed a 3rd vuln on my lunch break because I wondered, "what if I just got lucky and hit the places that were actually vuln?"
lol

2024-05-16 15:04:22

- reply

One of the most frustrating things I deal with as a security researcher goes like this.
Me -> vendor: "This is a problem"
Vendor -> me: "That's not in our threat model"
Customers -> vendor: "...wait, I thought you prevented that attack by design"

2024-05-16 03:50:04

- reply

I suspect there are even more, but that's as much of my time and energy as I want to put into looking at their code.

2024-05-16 03:48:29

One of the Matrix developers saw fit to comment on my gist https://gist.github.com/soatok/8aef6f67fec9c702f510ee24d19ef92b?permalink_comment_id=5058644#gistcomment-5058644
In response, I actually looked at their code, identified two security vulnerabilities, and disclosed them to their security@ email.
This reaffirms the opinion I held previously.

2024-05-15 17:59:37

Okay, so Cwtch implemented PrivacyPass with Ristretto255 :blobfoxheartcute:
This is amazing

2024-05-14 16:26:53

It’s Time for Furries to Stop Using Telegram
I have been a begrudging user of Telegram for years simply because that's what all the other furries use. When I signed up, I held my nose and expressed my discontent at Telegram by selecting a username that's a dig at MTProto's inherent insecurity against chosen ciphertext attacks: IND_CCA3_Insecure. Art: CMYKat I wrote about Furries and Telegram before, and included some basic privacy recommendations.
http://soatok.blog/2024/05/14/its-time-for-furries-to-stop-using-telegram/

2024-05-12 01:00:16

- reply

I've been yapping about the exponential growth of the fandom and how poorly our community is handling it for years now

2024-04-29 04:32:33

I'm not going to mince words.
Fursuits are adorable and I enjoy seeing them. Please post more.
Thank you.

2024-02-07 04:43:18

It's still bewildering to me how puritans be like, "Sex is an addiction that corrupts the soul"
Meanwhile I can ask the kinkiest, horniest fuckers I know for platonic cuddles and they're okay with that