Niel Liesmons

If we have a persistent, biometrically-protected, cross-device key, what if we could use it to do arbitrary cryptography rather than just authentication? As it turns out, we can. The WebAuthn PRF extension – while still relatively new – is now beginning to see fairly wide support:

Source

6/17/2026

fractional indexing inside encrypted blobs, sorted client-side – is nice because it hides everything. The server learns nothing about your folder names, nothing about their order, nothing about how often you rearrange them. All it sees is a collection of opaque ciphertexts and timestamps.

Source

6/17/2026

The main insight is that strings, unlike integers, have infinite room between any two values. Between “a” and “b” there’s “aV”. Between “a” and “aV” there’s “aK”. You can always find a midpoint. No matter how many times you reorder, you only ever update one folder.

Source

6/17/2026

What about human-friendly peer names? Those are almost required for end-user friendly applications. Most solutions of that problem either assume that every single user is willing to dedicate their life to configuring DNS, rely on a trusted third party, or delegate the responsibility to a blockchain.

Source

6/15/2026

Iroh is QUIC. We are not trying to reinvent the wheel here, just combining existing IETF RFCs in a creative way.Here is a concrete problem we solve. You have one device in your home WLAN behind a NAT. Your other device is in a 4g network, or behind another NAT at work.In most cases we can give you a direct connection between the two devices very quickly via hole punching, so you get the highest possible bandwidth and the lowest possible latency.This was not a solved problem until now.

Source

6/15/2026, 1 engagement

communities on Bluesky will get their own handle that doubles as a URL

Source

6/15/2026

Younger generations do not think in folders, inboxes, subjects, and signatures. They think in threads, voice notes, reactions, and instant replies.

Source

6/15/2026, 7 engagements

Show me the JavaScript framework (or tool that exports JS) that you can give it to a middle schooler and have them make a cartoon with audio and moving images that they can draw themselves, while responding to user input. Have the exported artifact be consistent across all major operating systems and browsers.Yeah, Flash was never replaced

Source

6/15/2026

I never bought the benevolent technical angle for not supporting flash. I'm pretty sure Apple strategists knew the value of the gate-kept platform, the app-store revenue stream.The pivotal point was that flash would break this stronghold by allowing rich applications that are reasonably self-publishable. (Excuse me while I go rinse that sentence out of my mouth)

Source

6/15/2026

We provide the first prefix authentication schemes thatasymptotically (and practically) outperform the certificatetransparency logs, both in the amount of required metadataand in the size of the data that certifies that some string is aprefix of another.

Source

6/15/2026

Reed is a transitive prefix authentication scheme (Meyer, 2023bb): given a sequence of events, we construct a directed acyclic graph (DAG), whose edges correspond to one object containing a secure hash of the other object (i.e., a Merkle-DAG). For each event, we assign a commitment vertex which has a path to the event, as well as paths to the commitment vertices of all earlier events. Given the commitment vertices of two events and the out-neighborhood of the path between them, we can reconstruct the hashes of all path vertices, thus proving that the first event did indeed happen before the other. Reed guarantees that the out-neighborhoods of these paths are small, i.e., verification is efficient.

Source

6/15/2026

Instead of pursuing logarithmic rekey efficiency like MLS, wedo a simpler linear-cost encryption of the group key to members’ update keys. This simplerdesign makes it easier to provide security against malicious insiders, thanks to our multi-recipient verifiable encryption (mVE) protocol. Being resilient against malicious insidersensures that group members cannot corrupt the group state (and block access), or partitionthe group into two sets with different key material

Source

6/12/2026

lice and Bob each submit signed changes; the server orders themand broadcasts each change with a per-change tracer proof to every online member. WhileBob is offline, Alice continues to write and the server batches her changes into a fast-forwardproof, which Bob verifies on reconnect. Normal reads and writes then resume, with readsserved via tracer proofs rooted at the current data commitment.

Source

6/12/2026

To developers, an encrypted space looks like a sync engine (middleware that ensures multipleclients have consistent views of shared state), with built-in support for group management.Behind the scenes, the space automatically implements cryptographic protocols to encryptdata, manage keys and users, and verify the authenticity and integrity of the data. Ourarchitecture aims to be flexible enough to support common collaborative applications suchas shared drives and documents, calendars, spreadsheets, source code control, artistic andengineering design applications, and chat forums.

Source

6/12/2026

Other projects have built clean-slateapplications that pervasively incorporate authenticated data structures and cryptographi-cally verifiable computation to allow clients to audit server behavior [42, 27, 60]. However,these efforts typically ignore the real-life complexities of key negotiation and rotation, par-ticularly as group membership and data retention policies change.

Source

6/12/2026

TEEs still require clients to trust the hardwarevendor and partially trust the cloud operator [

Source

6/12/2026

Believing that AI will save time is like being a person in the late 1800s seeing their first car and thinking “oh how easy it’ll be to get to the meadow now!” People back then didn’t imagine that by the 1960s we’d be stuck in traffic jams for hours in mega-cities.

Source

6/11/2026, 9 engagements

Many of us think that speed is overrated or, how the venerable Brett Scott put it a few days ago, Tech doesn’t make our lives easier. It makes them faster.

Source

6/11/2026

there is a simple twist to prevent account abuse: A chatmail service doesn’t allow to send un-encrypted messages to anyone outside the service. This makes spammers sad who would try to abuse open-signup chatmail addresses because they first would need to setup OpenPGP encryption with all recipients

Source

6/11/2026

Chatmail core offers a high level JSON-RPC API for managing contacts and chats, and for sending and receiving instant messages via e-mail and P2P realtime messages, while quietly taking care of many low-level details:

Source

6/10/2026

Hosting costs for 100K relay users are around half a Cent per user and year.

Source

6/10/2026

Chatmail relays provide ephemeral transport only, not long-term storage, and rely on cryptographic interoperability standards to interact with other MTAs, entirely cutting out the need for IP reputation and spam-checking machinery.

Source

6/10/2026

The Cryptree achieves these properties by leveraging thefile system’s folder hierarchy. Our tests indicate that Cryp-tree manages keys about four times as fast as previouslyproposed approaches.

Source

6/8/2026

The number of keys to be managed shouldnot grow proportionally to both, the number of filesand the number of involved users. Furthermore, theusage of expensive asymmetric cryptography shouldbe minimized

Source

6/8/2026

The more users interact in a file system,the more important it is to have useful and intuitive ac-cess control semantics. In particular, we require ourfile system to support confidentiality and dynamic in-heritance of access rights

Source

6/8/2026

The other issue is that the PDS isn't necessarily design for streaming lots of small events like chat messages. There are rate limits on writes to the PDS, and the firehose isn't low-enough latency to use for chat synchronization.

Source

6/8/2026, 5 engagements

When Roomy needs to prove to OpenMeet that a user is who they claim to be, it asks the user’s PDS to sign a JWT addressed to OpenMeet. OpenMeet verifies that signature by resolving the user’s DID document and checking the signing key. No shared secrets between the apps. No centralized auth server. No OAuth dance between Roomy and OpenMeet.

Source

6/8/2026

A private website can also link to any other websites in Peergos, including those owned by others, by the human readable path in the Peergos global filesystem. Following such a link will only work if you also have read access to the destination.

Source

6/5/2026, 1 engagement

Sharing files with other users is done through follow requests. Follow requests are asymmetrically encrypted with a hybrid of X25519 and MLKEM. This means all files are safe against exposure to a current or future large quantum computer, should one be built.

Source

6/5/2026, 7 engagements

In a world where everything you do is tracked and everything you post is analyzed, private posts which cannot be read by anyone you haven’t chosen are very censorship-resistant.1 And the only way for that to happen is if you run your own platform. And when you do run that platform, something magical happens: You stop self-censoring yourself.

Source

6/5/2026, 1 engagement

Some of the things my wife and I have provided for our kids:- lots of bookcases with probably >1500 books (including lots of kids/picture books) - what we've collected over the years- a family laptop (2012 MacBook Pro) with no internet connection, pre-loaded with Pages, Sheets, Affinity Photo/Designer, a few small games, and some coding tools (Python, Ruby, VSCode, Scratch, etc.).- Lego Spike and Spike Prime robotics learning sets (with software on an iPad, no internet)- an upright piano (originally for me, but now they're taking lessons; I got it for $700 at a closeout sale at a piano store)- a MIDI keyboard connected to Pianoteq running on an iPad in single-app mode with a couple of self-powered studio monitors and headphones- an old-school landline phone connected to a VoIP box, served by UniFi Talk ($10/month).- Each of them has their own CD player boombox, we have a large collection of CDs- An iPad with Audible, disconnected from the internet, but with our audio book collection available (over the years, it's gotten into the hundreds of books)- starting from when they were very young, I've been periodically loading up Cosmic Osmo (CD edition, from an un-stuffed .img file) running on an emulated Quadra 650 in System 7.5.3 on InfiniteMac.org and let them play for an hour or two at a time. This is such a good game for kids - literally black and white (dithered grays), not overstimulating, very thoughtfully built, sparks imagination and curiosity, full of easter eggs.- some good play equipment and a hammock in the back yard

Source

6/5/2026, 2 engagements

experiencing missed messages is a frequent complaint of other shared heap architecture designs such as Secure Scuttlebutt and Nostr, where missing message replies are even more common than on ActivityPub and other message-passing federated architectures

Source

6/3/2026, 1 engagement

This is all to say: blogging plus feed readers started out a lot more decentralized than Bluesky has, and having one big player enter the room and then exit effectively killed the system.

Source

6/3/2026

Most respectable engineers know to avoid lock-free techniques at all costs.

6/2/2026, 1 engagement