# google com (blogs) — RSS Amplifier Recent posts from the 4 feeds in the RSS Amplifier directory that cover google com. Page: Feed: --- ## [(untitled)](https://abyssdomain.expert/@filippo/117117691420946937) _2026-08-18 · Filippo Valsorda_ Oh, I just realized quantum computers (and the massive size of ML-DSA signatures) will probably kill asymmetrycally-signed JWTs as bearer tokens. This is good. 90% of the time, asymmetric signatures are unnecessary complexity, and a session ID or a HMAC would do just as well. Also, crypto libraries consider signatures public, while ~all signed bearer token schemes abuse them as the only secret… ## [(untitled)](https://abyssdomain.expert/@filippo/117112876449521516) _2026-08-17 · Filippo Valsorda_ I am mostly done implementing crypto/passkey, but now I need YOUR help collecting real-world traces for its test suite! Please go to https:// help-test-crypto-passkey.exe.x yz and click the buttons. It should take 1–3 minutes. 𝘌𝘴𝘱𝘦𝘤𝘪𝘢𝘭𝘭𝘺 if you have some unusual Linux-on-the-desktop xkcd 1987 passkey setup. ## [(untitled)](https://abyssdomain.expert/@filippo/117105417748756637) _2026-08-16 · Filippo Valsorda_ From the "things that would have been too much effort before but take no time with LLMs and exe.dev" category. ## [The Perfect P&L](https://drewfallon.substack.com/p/the-perfect-p-and-l) _2026-08-14 · Drew Fallon · Making Cents_ The Perfect P&L is below ## [When is your brand ready to sell?](https://drewfallon.substack.com/p/when-is-your-brand-ready-to-sell) _2026-08-14 · Drew Fallon · Making Cents_ Come through diligence with me ## [(untitled)](https://abyssdomain.expert/@filippo/117088063853215709) _2026-08-13 · Filippo Valsorda_ Huh, it’s not every day that an LLM suggests on the issue tracker a low-hanging fruit change that saves 30% on X25519 handshakes. We already had a much faster edwards25519 fixed-base scalar mult, which can be used for half of ECDH with a small mapping. (The other half of X25519 is “special.”) https:// go-review.googlesource.com/c/g o/+/814601 ## [(untitled)](https://abyssdomain.expert/@filippo/117076493635303465) _2026-08-11 · Filippo Valsorda_ Made a little nice monitoring tool for CT logs. https:// uptime.geomys.org/ct/ When queried, it submits a per-minute deterministic precert to the log, checks the SCT, fetches the STH, checks inclusion of the SCT, returns 200 if all is good. I'm generally a big fan of prod end-to-end testing. https:// groups.google.com/a/chromium.o rg/g/ct-policy/c/RcKh1\_LxoB0/m/\_oS4OcuOCwAJ ## [(untitled)](https://abyssdomain.expert/@filippo/117072077358334187) _2026-08-10 · Filippo Valsorda_ On Saturday night, one of our CT logs rejected most submissions for 30 minutes. I just published the post-mortem, and the investigation was... a lot of fun? It involves Go mutex starvation, SQLite WAL behavior, and ZFS record sizes. I got to SIGKILL a VM 200 times, implement a turnstile (TIL!), and order a Nokia flip phone. https:// groups.google.com/a/chromium.o… ## [(untitled)](https://abyssdomain.expert/@filippo/117055470850570738) _2026-08-07 · Filippo Valsorda_ It’s very clear by now that if LLMs are not improving your software quality it’s either a revealed preference (yours or your org’s) for more volume vs more quality, or a skill issue. The level of testing and review they are enabling in the Go cryptography standard library is amazing. ## [How to Succeed with AI at Your Brand](https://drewfallon.substack.com/p/how-to-succeed-with-ai-at-your-brand) _2026-08-02 · Drew Fallon · Making Cents_ A primer on data infrastructure and AI ## [Trade Bitcoin and Ethereum Today (Sponsored)](https://crawlproof.com/a/PQjgDRCkTwQN) _2026-08-02 · **Sponsored**_ Buy, sell, and margin trade BTC and ETH with EUR, USD, CAD, GBP, or JPY. ## [(untitled)](https://abyssdomain.expert/@filippo/117016537896644575) _2026-07-31 · Filippo Valsorda_ After a year and a quarter of operating the Tuscolo Certificate Transparency log (with a total of 8 minutes of planned downtime)... I am happy to announce the second Geomys CT log: Trastevere! It's basically identical, except it's a Dell PowerEdge R6515 racked in @ seeweb 's Frosinone, Italy datacenter. https:// groups.google.com/a/chromium.o… ## [(untitled)](https://abyssdomain.expert/@filippo/116986126532606745) _2026-07-26 · Filippo Valsorda_ It's not my usual beat, but I wrote a pure-Python ML-DSA verifier. pip install mldsa It's 350 lines, CC0/0BSD, single-file, no dependencies, and thoroughly tested. Signature verification handles no secrets, so it doesn't need to be constant-time. https:// words.filippo.io/mldsa-py/ ## [Inside IM8's $1B Raise from General Catalyst](https://drewfallon.substack.com/p/inside-im8s-1b-raise-from-general) _2026-07-25 · Drew Fallon · Making Cents_ & How the true cost of the capital tells us the real story ## [IM8 GC ANALYSIS](https://drewfallon.substack.com/p/im8-gc-analysis) _2026-07-25 · Drew Fallon · Making Cents_ https://drive.google.com/drive/folders/1by\_-nMXYtY3A0jl3zxfTE4glPX7A7Me1?usp=drive\_link ## [(untitled)](https://abyssdomain.expert/@filippo/116954883961436258) _2026-07-20 · Filippo Valsorda_ Passkeys can be stored just like password hashes! I'm proposing an interoperable $webauthn$v=1$… format, and a Go API that uses these passkey records for authentication. I'm looking for feedback before proposing this as crypto/passkey for Go 1.28! https:// words.filippo.io/passkey-recor d/ ## [(untitled)](https://abyssdomain.expert/@filippo/116930505133626581) _2026-07-16 · Filippo Valsorda_ "Could you support $SMALL\_TWEAK? We need it for $OBSCURE\_PROTOCOL. It's very small! Why not?? Do you hate us?" Here is a bunch of work to fix assembly that assumed it could overread/write the AES-GCM ciphertext because it'd be followed by 16 bytes of tag, but we regrettably support custom tag sizes. https:// go.dev/cl/801600 (Also, what I think are some pretty cool systematic page-faulting tests.) ## [(untitled)](https://abyssdomain.expert/@filippo/116918596450085389) _2026-07-14 · Filippo Valsorda_ Setting up Gerrit on exe.dev with X-ExeDev-Email auth took 60s! However, that doesn't make git work. I hacked together a little proxy that does a tiny amount of OAuth2, exchanging exe.dev auth in the browser for a token that works with git-credential-oauth. https:// github.com/filippo-claude/gerr it-exedev-auth-proxy ## [(untitled)](https://abyssdomain.expert/@filippo/116897088324257507) _2026-07-10 · Filippo Valsorda_ The endless long tail of the post-quantum transition includes: Apple Business encrypts FileVault recovery keys to a customer-generated RSA public key. There's a literal "openssl req -newkey rsa:2048" in the docs. https:// support.apple.com/guide/busine ss/filevault-configuration-axm1dd824baf/web ## [GYMSHARK FINANCIALS & VALUATION](https://drewfallon.substack.com/p/gymshark-financials-and-valuation) _2026-07-10 · Drew Fallon · Making Cents_ One of my best analyses yet ## [BEN FRANCIS TO BUY BACK GYMSHARK SHARE FROM GA](https://drewfallon.substack.com/p/ben-francis-to-buy-back-gymshark) _2026-07-10 · Drew Fallon · Making Cents_ A story of multiple compression, preferred rights, and ## [Ship software peacefully (Sponsored)](https://crawlproof.com/a/FGw2WDBLtFng) _2026-07-10 · **Sponsored**_ Connect your repo and deploy instantly — Railway handles config, scaling, and monitoring. ## [REFORMATION S1 BREAKDOWN](https://drewfallon.substack.com/p/reformation-s1-breakdown) _2026-07-03 · Drew Fallon · Making Cents_ A deep dive ## [REFORMATION FINANCIAL ANALYSIS](https://drewfallon.substack.com/p/reformation-financial-analysis) _2026-07-03 · Drew Fallon · Making Cents_ https://drive.google.com/drive/folders/1s6Ma4HLAG33QBHLDeF1FJj3c1NdqEDo0?usp=drive\_link ## [(untitled)](https://abyssdomain.expert/@filippo/116817753230085862) _2026-06-26 · Filippo Valsorda_ https:// securitycryptographywhatever.c om/2026/03/25/ai-bug-finding/ is very very good. If you read my vulnerabilities post, this podcast episode is much more worth listening to. ## [(untitled)](https://abyssdomain.expert/@filippo/116799613893928625) _2026-06-23 · Filippo Valsorda_ We all know vulnerability reports are not like ordinary issues. But why? It comes down to needing the scarce insight and temporary confidentiality to protect users. However, now that LLMs can find more or less the same bugs for everyone, none of that matters, and vulnerability reports are not special anymore. https:// words.filippo.io/vuln-reports/ ## [(untitled)](https://abyssdomain.expert/@filippo/116795795287641020) _2026-06-22 · Filippo Valsorda_ There we go. US Government tightens post-quantum cryptography transition deadlines for high-value systems to 2030 for key exchange and 2031 for signatures. Also, speeding up the CMVP (FIPS 140 validation) processes. That’s how you know the rush is real. The quantum computers are (potentially) coming. https://www. whitehouse.gov/presidential-ac… ## [(untitled)](https://abyssdomain.expert/@filippo/116781705785046708) _2026-06-20 · Filippo Valsorda_ In 2020, OpenSSL had a vulnerability in handling the signature\_algorithms\_cert extension. https:// openssl-library.org/news/secad v/20200421.txt Palo Alto apparently "solved" this in their IPS by blocking connections with "unknown" algs in signature\_algorithms\_cert. Six years later, we can't add ML-DSA to signature\_algorithms\_cert in Go. signature\_algorithms\_cert is dead. Sigh. Thanks to @ cks for… ## [Prestige Consumer's $1B Acquisition of Breathe Right - the deal no ones talking about](https://drewfallon.substack.com/p/prestige-consumers-1b-acquisition) _2026-06-19 · Drew Fallon · Making Cents_ & why you should care - a deep dive into the transaction ## [(untitled)](https://abyssdomain.expert/@filippo/116721774789980199) _2026-06-09 · Filippo Valsorda_ There's been some confusion around some BRs non-compliant X.509 chains that OpenSSL accepts but Go rejects. We're not going to introduce complexity in crypto/x509 to support them, but I realized you could always re-encode the issuer as an unsigned root to work around it. So I made a little web tool to make it easy. https:// github.com/golang/go/issues/31 440#issuecomment-4663196149 ## [(untitled)](https://abyssdomain.expert/@filippo/116681764122312470) _2026-06-02 · Filippo Valsorda_ Can you see how to use a test vector that provides (seed, public key, message, µ, signature) to test a deterministic signing API that does (seed, message) → (signature) or a key generation API that does (seed) → (public key)? Noted cryptographer D. J. Bernstein can't, certainly in good faith. \*sigh\* I jest, but refuting this FUD takes real resources we could spend so, so, so much better. It'd be… ## [(untitled)](https://abyssdomain.expert/@filippo/116635735777653062) _2026-05-25 · Filippo Valsorda_ I am live with Alex Gaynor to talk about the Geomys model of professional open source maintenance and how it helps projects face challenges, like the recent influx of LLM vulnerability findings! Join us live on https://www. twitch.tv/filosottile right now or catch the recording soon! ## [Privacy-first AI-native browser (Sponsored)](https://crawlproof.com/a/AGIT37cquOto) _2026-05-25 · **Sponsored**_ No telemetry or ads — built on Ungoogled Chromium with a built-in AI sidebar and CLI. ## [(untitled)](https://abyssdomain.expert/@filippo/116482810346128605) _2026-04-28 · Filippo Valsorda_ Looks like GitHub silently corrupted some index. PR #237 definitely exists and is closed ( https:// github.com/C2SP/C2SP/pull/237 ) but is just... not in the list ( https:// github.com/C2SP/C2SP/pulls?q=i s%3Apr+is%3Aclosed ) regardless of filters. I briefly doubted my own sanity. This is bad. ## [(untitled)](https://abyssdomain.expert/@filippo/116479410378819417) _2026-04-28 · Filippo Valsorda_ A brief timeline of the Go FIPS 140-3 validation: - February 2024: first prospectus - March 2024: started working with lab - July 2024: first contract - September 2024: opened issue - January 2025: froze module - May 2025: submitted validation - April 2026: certificate issued ## [(untitled)](https://abyssdomain.expert/@filippo/116479410369880468) _2026-04-28 · Filippo Valsorda_ If you'd like, you can buy a number of services from us, including rebrands and listed Operating Environments: https:// geomys.org/fips140 However, you don't have to. Our certificate has one of the broadest list of tested environments (and algorithms) of the industry, and you can just use it with stock Go 1.24+ and GOFIPS140=v1.0.0, courtesy of Geomys. Because the point was removing this roadblock… ## [Selfhosting git with cgit and git-http-backend](https://jfr.im/blog/2026/01/selfhosting-git-cgit-and-git-http-backend/) _2026-01-02 · Posts on JFR's Musings_ I’ve been self-hosting my git repositories for some time, but I’ve just upgraded them to use git-http-backend. Previously, clones were served by cgit (and before that by gitweb), which both present as a “dumb HTTP transport”. The smart protocol is much faster, though, especially with relatively high latency like my repositories tend to have. Git includes a CGI… ## [Capitalism](https://jfr.im/blog/2025/09/capitalism-minimizes-efficiency/) _2025-09-05 · Posts on JFR's Musings_ (Originally written as a response to the video Electricity is About to be Like Housing by Hank Green. Go watch it.) The one true constant of capitalism is not that it moves towards efficiency. That is an outright bald-faced lie. Capitalism grows towards maximum profit extraction (i.e. minimum efficiency). Those capitalists who are willing to behave more badly than the rest (loss lead their… ## [Recovering LUKS keys from running system](https://jfr.im/blog/2025/03/recovering-luks-keys/) _2025-03-19 · Posts on JFR's Musings_ The other day, while doing some normal maintenance and removing a few files, I accidentally removed the only copy of a particularly important disk encryption key. I have no backups for most of the data on these drives 1 , and while it would be possible to rebuild most of it, it would take significant effort. To make matters worse, while I theoretically had the drive space available to copy the… ## [AWS: Abusive Web Services](https://jfr.im/blog/2024/09/aws-abusive-web-services/) _2024-10-01 · Posts on JFR's Musings_ For many, many years now, AWS has been the top source of abusive traffic I’ve actually received. That’s not to say that they’re the top source of abusive traffic sent over the Internet. Rather, they have so many legitimate users that it gets through spam filters and blocklists. From outright spammers using SES, to Anthropic’s crawlers which sent my little site over 1… ## [Google domain-wide delegation + curl](https://jfr.im/blog/2024/09/google-domain-wide-delegation--curl/) _2024-09-19 · Posts on JFR's Musings_ Google makes it pretty easy to use a service account with domain-wide delegation through their SDKs (spoiler alert, you just download the service account credentials file from Google, point the SDK at it, and then call a setSubject('whoever@example.com') method). But how do you do this without their SDKs (which are usually thoroughly undocumented) getting in the way? The answer turned out to… ## [Zebra network discovery protocol](https://jfr.im/blog/2024/09/zebra-network-discovery-protocol/) _2024-09-11 · Posts on JFR's Musings_ I had cause to reverse-engineer the mechanism by which Zebra printers are discoverable, and am documenting the information, such as it is, here. Discovery client sends a UDP packet to port 4201 (unicast or broadcast), containing the data: 0x2e2c3a010000 , or .,:\\x01\\x00\\x00 . Actually, the discovery client sends 3 identical such packets (from the same socket), then waits 1 second, then repeats the…