Top all-time · #407
Dhole Moments
Personal blog · soatok.blog · on HN as some_furrysecurityprogramming
Dhole Moments is a personal blog at soatok.blog about security and programming. Since 2020, 136 different Hacker News readers have linked it 407 times, most often “What to Use Instead of PGP”. It is still writing: the last post was on 2026-10-29, and you can follow it by feed.
Sometimes recommended · 7 of 40 sampled comments recommend it?
Why HN links it
Linked for crypto and messenger security explainers: Signal versus Session, Matrix and XMPP flaws, and AES-GCM. Commenters call his explainers excellent and cite them as sources.
- Recommended for · 7 comments
- technical posts top notch; excellent explainer; great gatekeeping post; covered it very well; recommended reading
Summarised by Claude from a sample of 40 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Writings about information security, cryptography, software, and humanity, from a member of the furry fandom with a dhole fursona.
Most-linked posts?
- What to Use Instead of PGP11 people · 14 mentions · first linked 2024-11-15
- Against XMPP+omemo9 people · 11 mentions · first linked 2024-08-04
- Database Cryptography Fur the Rest of Us8 people · 10 mentions · first linked 2023-03-01
- Why AES-GCM Sucks7 people · 9 mentions · first linked 2020-05-13
- What We Do in the /etc./Shadow – Cryptography with Passwords7 people · 7 mentions · first linked 2022-12-29
- Security Issues in Matrix's Olm Library6 people · 10 mentions · first linked 2024-08-14
- GNU: A Heuristic for Bad Cryptography6 people · 7 mentions · first linked 2020-07-08
- What Does It Mean to Be a Signal Competitor?6 people · 6 mentions · first linked 2024-07-31
- When Soatok Used Bugcrowd5 people · 6 mentions · first linked 2022-06-14
- Don't Use Session (Signal Fork)5 people · 5 mentions · first linked 2025-01-15
What Hacker News says?
We had started off with AES, and the performance was abysmal on low-end mobie devices and certain web browsers. XChaCha20 in comparison added negligible latency and seemed less prone to human errors. These weren't the sole reason however. There's a lot of literature on the security aspects of XChaCha20, some of which I'll link below: - https://soatok.blog/2020/07/12/comparison-of-symmetric-encry... (in our case your…
Comment linking /2020/07/12/comparison-of-symmetric-encryption-methods/
on “Show HN: We built an end-to-end encrypted alternative to Google Photos”Submitted The insecurity of telecom stacks in the wake of Salt Typhoon as a story · 312 points
HN discussionYou'd think that, but I'm as much a critic of the worst parts of the furry community as any outsider. And, to practice what I preach, here's some evidence: https://soatok.blog/2025/06/12/furries-need-to-learn-that-su... https://soatok.blog/2022/06/21/a-greymuzzles-lament/ +
Comment linking /2022/06/21/a-greymuzzles-lament/
on “Laptops with Stickers”Submitted Against the censorship of adult content by payment processors as a story · 255 points
HN discussionI'm building an open source Federated Public Key Directory, so that I can then build end-to-end encryption for the Fediverse. https://github.com/fedi-e2ee/public-key-directory-specificat... Think: Encrypted DMs for Mastodon. I wrote several blog posts about the project and why it matters. https://soatok.blog/2024/08/21/federated-key-transparency-pr... https://soatok.blog/2024/06/06/towards-federated-key-transpa... h…
Comment linking /2022/11/22/towards-end-to-end-encryption-for-direct-messages-in-the-fediverse/
on “Ask HN: What are you working on (August 2024)?”Submitted Hell is overconfident developers writing encryption code as a story · 201 points
HN discussionI wouldn't trust Matrix for my personal security: https://soatok.blog/2024/08/14/security-issues-in-matrixs-ol... https://web.archive.org/web/20240606031827/https://gist.gith...
Comment linking /2024/08/14/security-issues-in-matrixs-olm-library/
on “Germany must stand firmly against client-side scanning in Chat Control [pdf]”Submitted Reviewing the cryptography used by Signal as a story · 172 points
HN discussionExcept for the fact that the security of Session is drastically worse than Signal. https://soatok.blog/2025/01/14/dont-use-session-signal-fork/ https://soatok.blog/2025/01/20/session-round-2/
Comment linking /2025/01/20/session-round-2/
on “By default, Signal doesn't recall”Submitted The Tech Industry Doesn't Understand Consent – Opt-Out Is Not Consent as a story · 126 points
HN discussionA while back I helped a friend (read: dumped a bunch of compute power into it) brute force the SSL keys for Sega's "Phantasy Star Online" Dreamcast game. They used a similar kind of custom (and flawed) TLS implementation in their game(s) which allowed signing new certificates after brute forcing. The benefit to this is that users can now play these games without needing to burn a new CD with either the SSL certs swa…
Comment linking /2025/01/31/hell-is-overconfident-developers-writing-encryption-code/
on “I've factored the RSA keys of a Certificate Authority from the 90s”Submitted The Continued Trajectory of Idiocy in the Tech Industry as a story · 94 points
HN discussionThis fact has forced people to write browser extensions to filter Pinterest out. I opt for the "teach non-tech people how to dork" route instead: https://soatok.blog/2020/07/21/dorking-your-way-to-search-re...
Comment linking /2020/07/21/dorking-your-way-to-search-results-that-dont-suck/
on “A one-line change decreased our build times by 99%”Submitted Crackpot Cryptography and Security Theater as a story · 94 points
HN discussionMost of what I've learnt here was less from books and more from colleagues/seminars and reading research papers. You can get a brief introduction at https://soatok.blog/2020/04/26/a-furrys-guide-to-digital-sig... (your own choice if you want that open in a tab at work or not, but there's nothing NSFW in the usual sense in there), and then read the details of each scheme in the RFCs. Some of the RFCs even talk about…
Comment linking /2020/04/26/a-furrys-guide-to-digital-signature-algorithms/
on “Bitcoin puzzle #66 was solved: 6.6 BTC (~$400k) withdrawn”Submitted Should you delete your Patreon account after they laid off their security team? as a story · 86 points
HN discussionIRC does not store messages, it only relays them to clients. You need an add-on solution to store chat history, something we've been taking for granted for ~30 years. IRC all but requires using a bouncer to follow a conversation from more than a single device. IRC does not encrypt messages, only (optionally) the client<->server connection. Without E2EE, you have no privacy against the server/operator, which is an ea…
Comment linking /2024/08/14/security-issues-in-matrixs-olm-library/
on “How Discord stores trillions of messages (2023)”Submitted An appeal to companies doing AI as a story · 80 points
HN discussionGood job releasing your project! It's a cool idea and surprisingly minimalist. That said, I've found a number of cryptographic flaws in the application source. This should not be used in instances where the encryption is mission-critical. 1) You generate a random key [0] and then feed it into PBKDF2 [1] to generate a 32-byte AES-GCM key. If you can generate 32 random bytes instead of 10 reduced-ASCII characters and…
Comment linking /2020/05/13/why-aes-gcm-sucks/
on “Show HN: 1-FPS encrypted screen sharing for introverts”Submitted Guidance for Choosing an Elliptic Curve Signature Algorithm as a story · 71 points
HN discussionDoesn't help that all of the major decentralized protocols have been very effectively undermined and pushed aside. GTalk first de-federated (weakening XMPP as a whole), then killed XMPP support completely. Reader effectively killed RSS for casual users. Email has been swallowed whole by the oligopoly of GMail+Yahoo+Outlook+iCloud+etc; spam is a real problem, so if you're self-hosting your email, you kinda expect to…
Comment linking /2024/08/14/security-issues-in-matrixs-olm-library/
on “Nostr”Submitted Don't Use Session (Signal Fork) as a story · 68 points
HN discussion> I am wondering how that relates to searching for the token in a database (index). Does it still matter? It can, but the practicality of exploiting this timing leak isn't at all a settled issue. Previously, https://soatok.blog/2021/08/20/lobste-rs-password-reset-vuln...
Comment linking /2021/08/20/lobste-rs-password-reset-vulnerability/
on “API Tokens: A Tedious Survey”Submitted Key transparency and the right to be forgotten as a story · 68 points
HN discussionAfter my experience with LastPass (and trying to report cryptographic weaknesses), my answer to people considering switching is "RUN DON'T WALK" https://soatok.blog/2023/01/21/how-you-respond-to-security-r...
Comment linking /2023/01/21/how-you-respond-to-security-researchers-says-everything-about-you/
on “Feds Link Cyberheist to 2022 LastPass Hacks”Submitted Bizarre Design Choices in Zoom’s End-to-End Encryption as a story · 66 points
HN discussionI wrote a lot about a similar debate recently, but in the context of encryption at rest rather than encryption in transit https://soatok.blog/2022/08/18/burning-trust-at-the-quantum-... For brevity, start reading at "Isn’t cryptography fun?" which contains the relevant portion.
Comment linking /2022/08/18/burning-trust-at-the-quantum-village-at-defcon-30/
on ““Quantum-Safe” Crypto Hacked by 10-Year-Old PC”Submitted On the Toxicity of Zed A. Shaw (With Bonus 0days) as a story · 64 points
HN discussionCryptography stuff! ----- COCKTAIL-DKG - A distributed key generation protocol for FROST, based on ChillDKG (but generalized to more elliptic curve groups) -- https://github.com/C2SP/C2SP/pull/164 | https://github.com/C2SP/C2SP/issues/159 ----- A tool for threshold signing software releases that I eventually want to integrate with SigStore, etc. to help folks distribute their code-signing. https://github.com/soatok/…
Comment linking /category/technology/open-source/fediverse-e2ee-project/
on “Ask HN: What are you working on? (October 2025)”Submitted Age verification doesn't need to be a privacy footgun as a story · 56 points
HN discussion
