stf

https://pitchfork.ist, libopaque, https://sphinx.ctrlc.hu, pysodium, https://klutshnik.info, https://sphinx.pm

#searchable #cypherpunk

github: https://github.com/stef
blog: https://ctrlc.hu/~stef/blog/

Public Key

npub1akttsk6arp84hap4yedezu9cs8n6e9nhueph59u33npk6gtck4ps6xqyaf

NIP-05 Address

stf_at_chaos.social@momostr.pink

Profile Code

nprofile1qqswm94ctdw3sn6m7s6jvku3wzugreavjem7vsm6z7gcesmdy9ut2scprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntr3t5jw

Publishing to

relay.momostr.pink

Author Public Key

npub1akttsk6arp84hap4yedezu9cs8n6e9nhueph59u33npk6gtck4ps6xqyaf

Show more details

Last Notes

2026-10-12 20:15:44 UTC

https://github.com/h0m3us3r/w1700k-sdr
Turns a Gemtek W1700K Wi-Fi 7 router into a wideband software-defined receiver. The router's MediaTek MT7996 radio captures raw 14-bit IQ at up to 320 Msps, its Airoha AN7581 SoC streams it over 10 GbE, and a Linux host shows it as a live spectrum and waterfall in the browser, with the receiver's controls next to it.
#sdr #radio #hack

2026-10-12 13:12:46 UTC

- reply

what is your source for this claim that the incident started a week ago? i cannot see it in the linked press release.

2026-10-09 11:19:40 UTC

- reply

i love your "* of the week" however i just noticed (talk about cognitive blackspot) that it ends in a "Read more >" right 2 points in Threats section. would it be possible to split this up into a thread, and hashtag it properly like "#linksoftheweek" "#longthread"?

2026-10-08 13:02:17 UTC

- reply

dear Jeff, could you explain how this can be exploited? and knowing there have been similar controversial domains before - e.g. like .com - if you know of any publicly reported exploitation of such tlds?

2026-09-24 12:09:52 UTC

- reply

friends of mine reused the nacelle of a turbine and built a tinyhouse of it: https://www.superuse-studios.com/projectplus/nestle/

2026-09-16 11:24:28 UTC

- reply

and when i say weird connector, i mean this:
#bosch #proprietary #ebike
usb pd should be mandatory for these as well! damnit.
https://assets.chaos.social/media_attachments/files/117/280/456/425/221/416/original/eca1efb341508aac.png

2026-09-16 11:15:13 UTC

- reply

i have an #ebike with #bosch controller/battery, it's a closed walled garden, the charger has an incredibly weird connector, and the controller itself doesn't work with anything else but their own app. luckily i found a small spanish boutique shop that sells a mitm device for their controller (i suspect it's just an esp32) that broadcasts all telemetry on common protocols/uuids that the rest of the app/devices supports.
my advice stay away from bosch stuff on ebikes, #proprietary shit.

2026-09-10 14:17:28 UTC

- reply

they exist! https://de.aliexpress.com/item/1005005084323657.html
comes with a voice changer, dual sim and is painless to hide!
this one you can probably hide in your nose even: https://de.aliexpress.com/item/1005007335784623.html

2026-09-05 21:04:20 UTC

\o/ #klutshnik server now also builds with #zig v0.16 \o/
https://rad.ctrlc.hu/nodes/rad.ctrlc.hu/rad:zogkw4qiTrH7rKVa89BrKo8z5miA/commits/699e50ac9301b94b4854438f9021ef73160709f9
was quite easy after updating zphinx* before.
https://klutshnik.info - unlike the common tools like pgp and age - is an online threshold data-at-rest crypto system that provides very cheap and efficient key-updates and thus forward secrecy and post-compromise security.
*zphinx is an online threshold password manager far ahead of the competition in terms of security guarantees: https://sphinx.pm

2026-09-04 14:00:24 UTC

woohoo, just pushed an update to the zphinx* server to build with #zig v0.16 - due to the #iocalypse this is quite a substantial patch: https://rad.ctrlc.hu/nodes/rad.ctrlc.hu/rad:z2Rncctq4pLrY1Kp7NgQkcejBsiza/commits/86d8dc72f391cbedd9994a76fa67e29b3f631b22
but quite worth it, as i got rid of a lot of posixisms/linuxisms (not all though) so making it portable should be easier.
next up the klutshnik** server.
* wtf zphinx: https://sphinx.pm
** wtf klutshnik: https://klutshnik.info

2026-09-02 17:30:56 UTC

- reply

i would kill for a "kakasherés velős pacalpörkölt"* like they served anno in the "kiscsillag söröző"
[*] tripe stew with bone marrow and cock testicles.

2026-08-19 19:39:06 UTC

- reply

sorry for barging in here, but what is the definition in this case for "cybersecurity company" and for "tooling"? depending on the answer radicallyopensecurity might be contrapoint, i work for them and can help finding out if we fit or not that hat...

2026-07-31 13:12:37 UTC

anyone experienced with #outdoor high-speed #ethernet (~150m) cabling and possibly also somewhere half-way injecting solar-based PoE? is this a thing?

2026-07-12 22:50:05 UTC

- reply

where is it, in gelderland somewhere?

2026-07-01 12:42:01 UTC

RE: https://eupolicy.social/@whvholst/116844640728147355
sweet holy mother of surprise! surely not the same Aura Salla who was chief-lobbyist for facebook before being elected to the European Parliament?
#note1jhj…m050

2026-06-29 11:03:07 UTC

- reply

still sounds like org-mode to me. labels, definitely a well supported thing beyond hiliting. am i replyguying now? kill me...

2026-06-28 20:27:57 UTC

- reply

the org prefix is a hint what the original purpose was, and since it is about organizing, TODO is automatically highlighted, you can even have small [] checkboxes which you can check/uncheck, and top of the section will give you a nice percentage of how many subtasks are already completed. hiliting TODO in md is a very poor reimplementation of this. org-mode is amazing 4 organizing thoughts & todos. also very nice for latex beamer presentations & blog posts, but that is another story.

2026-06-28 11:31:30 UTC

- reply

“Those who do not understand Unix^Worg-mode are condemned to reinvent it, poorly.”

2026-06-08 22:31:55 UTC

insightful piece how the EP protected our rights, while the council refused to negotiate, and the commission intentionally created pressure and then even committed maladministration, again.
https://edri.org/our-work/did-the-eu-parliament-really-vote-not-to-protect-children-online/
#chatcontrol #europe #commission #parliament #council

2026-05-26 11:09:19 UTC

PRESS RELEASE
Today, our engineering team announced a streamlined editorial workflow powered by the Unix tool sed, enabling instant, consistent replacement of the symbol & with the word “and” across all communications. This improvement strengthens clarity, supports accessibility, and ensures brand‑wide linguistic consistency. By integrating sed into our publishing pipeline, we reaffirm our commitment to precision, efficiency, and high‑quality content delivery.

2026-05-12 12:37:23 UTC

#eurocrypt just happened, which reminds me of the eurocrypt 35 years ago held in budapest, which an #NSA cryptologist was attending and giving a scorching #report in the internal cryptolog newsletter of the nsa: https://scottaaronson.blog/?p=2059
would be interesting to see the latest cryptolog report on this latest edition...

2026-05-05 13:18:03 UTC

assuming you're a new free sw project, and you wrangle with finding a name for it. should there be a blacklist of forbidden names of which your projects name should be of a certain minimum levenshtein distance? like is starlink too close to stalin?

2026-04-22 15:55:52 UTC

if the part before the main, is the "prequel" then why is the part after the main a "sequel" and not a "postquel"?

2026-04-14 18:06:50 UTC

- reply

uh, i'm sure you're trolling, but i take the bait. that would be gratisbsd, with freebsd the implication is slavebsd

2026-04-12 19:41:23 UTC

i don't share any of the enthusiasm.
it is just replacing one old rightwing asshole, with a younger rightwing asshole.
unless there is wide and thorough anti-corruption investigations, convictions and large nationalization of stolen public funds, #orban wins... he retires and enjoys the spoils of stealing for decades.
#hungary

2026-04-12 17:04:48 UTC

- reply

maybe this https://youtu.be/0nt1CgQsgpI has some merit and is an explanation?

2026-04-06 12:05:12 UTC

- reply

indeed i remember the hilarity watching hungarian males trying to approximate sinus waves, like it was a competition...

2026-04-06 11:55:03 UTC

ah #easter #monday the day when male hungarians traditionally go out and dowse females with buckets of water or spray them with parfume.
#nojoke. what's wrong with these easter traditions?

2026-03-26 15:35:00 UTC

new global supply chain disruption prediction trigger unlocked: /me crowdfunds some neat stuff, supply chain disruption imminent/in-progress

2026-03-17 13:32:23 UTC

je suis #banksy!

2026-03-17 13:17:36 UTC

the *european* payment processor - #nexi - that the FSFE was using for donations, was doing some disproportional requests violating the #privacy of the #donors to the FSFE, and in the fog of war cancelled the contract with the #FSFE. Now the FSFE is hunting to get those 450 donors attention and donations back. details in this archived mail: https://ctrlc.hu/~stef/fsfe-nexi.txt
maybe some journalist could shine some attention at this case?

2026-03-14 18:55:54 UTC

- reply

just to make sure, i'm not contesting the content, am sure there is active info and psyops going on in .hu. the only thing i was noticing, that the text was weird.

2026-03-14 18:09:32 UTC

- reply

if you say this person exists, it was probably written in non-native english and then llm translated into hungarian.

2026-03-14 14:44:17 UTC

- reply

this text feels wrong both in english, which is excusable - the author having a hungarian name - but even the hungarian variant, word-order, grammatical structure, makes it feel like it was translated, to both languages from a 3rd language. which makes little sense as the author seems to be hungarian.
of course this is only a feeling, an analog signal, with a sample size of 1. so no hard evidence, but it feels wrong.

2026-02-23 18:32:21 UTC

a kind contributor packaged up #sphinx #passwordmanager for #archlinux - and even reported an incompatibility with py3.14 (hence the latest pyoprf release, from yesterday). so if you wanna give it a try, and were using arch, no excuse anymore.
https://link2xt.codeberg.page/blog/2026-02-22-sphinx-aur.html
check out https://sphinx.pm/ for more details

2026-02-23 12:19:57 UTC

The #NSA with the help of #philips #backdoored (again!) a european military messaging #device in the 80ies, a few years ago the fine people of the #cryptomuseum published everything they knew about it - including a #firmware dump:
https://www.cryptomuseum.com/crypto/philips/ua8295/
back then i #reverseEngineered this, and last week finally cleaned it up, and publish it today:
https://rad.ctrlc.hu/nodes/rad.ctrlc.hu/rad:z46AkAERuXAzqZcDRKvE7byRbkga1
also on the bad site: https://github.com/stef/UA-8295-NSA

2026-02-19 15:16:42 UTC

- reply

rotfl that illustration image. 6 years, i see what you're doing there.

2026-02-18 14:38:16 UTC

so this password manager paper: https://eprint.iacr.org/2026/058 starts with:
> We examine the extent to which security against a fully malicious server holds true for three leading vendors who make the Zero Knowledge Encryption claim: Bitwarden, LastPass and Dashlane
with https://sphinx.pm, we consider it - jokingly, with some caveats - normal to consider it a fully malicious server and to have the server hosted by the nsa/u8200/gru/prc is fine.

2026-02-10 13:39:30 UTC

my friend @npub1hjj…shkr built a thing again \o/ and it's great as always. read his own thoughts on this at https://hister.org/posts/how-i-cut-my-google-search-dependence-in-half/
and engage with the cringe on the orange site at https://news.ycombinator.com/item?id=46959554
#search #history #web #browser

2025-12-15 14:33:30 UTC

just released liboprf-0.9.3
liboprf is a library implementing the OPRF from https://www.rfc-editor.org/rfc/rfc9497.html and in addition it also provides a threshold variant (tOPRF) and a distributed key generation protocol for the tOPRF, as well as a key update protocol for the tOPRF shared secret. it comes with a high level python frontend that supports servers on TLS/USB and Bluetooth LE
see: https://github.com/stef/liboprf

2025-12-07 14:11:48 UTC

idea: add #llm support to #syslog so when nothing interesting is happening then it generates some exciting log entries, and if something interesting is happening it hides in the noise. just to keep SoC people entertained.

2025-11-25 12:51:56 UTC

- reply

- you can cause social problems with code
- you can degrade the system if you don't understand how or why it works
- you can produce obstructions for someone else without understanding how they work or what they are doing.

2025-11-14 15:44:41 UTC

- reply

so how is your public camera/km^2 density? according to our mapping, our 'hood has a ~ 1kcams/1km^2. you can help map it and then view the results on https://sunders.uber.space/ - mapping is incredibly easy using https://wiki.openstreetmap.org/wiki/Every_Door @npub1l32…wy7q adding a new cam is 5 taps if it is the same style as the previous one. Go on, have a walk, it's healthy and scary! #surveillance #openstreetmap #cameras

2025-11-13 20:28:56 UTC

we mapped 38ha in the local residential area, in total we found 410 cameras, with about 80-90% of those being ring or similar doorbell cameras. all of these pointing at the public sidewalks, all completely illegal. there is no way in this 'hood to move around without being tracked. people don't deserve the GDPR.
I imagine Bezos sitting at home and doing real-time tracking of individuals just based on facial recognition running on AWS.
fucking worst of all cyberpunk futures i hoped for. 😞

2025-10-15 20:04:54 UTC

yippie-kee-yay! just added teensy4.0 support to #klutshnik #zephyr - the 4.0 is smaller and cheaper than the 4.1 but comes with the same powerful cortex-m7 mcu. with this change klutshnik now runs on 4 different systems: xiao_esp32s3, rpi pico (w2) and the teensy4.1 and teensy4.0. \o/
also rewrote the provisioning interface which is now a proper shell on usb cdc-acm.
check it out on #radicle
rad:z2EBBi4vui98QV8Mk8DT3c25yZbJ4
or on the ms-trap: https://github.com/stef/klutshnik-zephyr

2025-10-14 12:33:25 UTC

\m/ dnet just released v0.6 of androsphinx, a v2.0 compatible #android client for the #sphinx #passwordmanager! \o/
you ask, wtf sphinx? check out: https://sphinx.pm
get the android client here: https://github.com/dnet/androsphinx/releases/tag/v0.6

2025-06-13 13:44:17 UTC

- reply

huh, that's a conversion that rax2 doesn't support ootb.

2025-05-18 15:27:37 UTC

- reply

1. xkbcomp -xkb $DISPLAY /tmp/a
2. vim /tmp/a
3. test xkbcomp /tmp/a $DISPLAY
4. put 3. into your .xinitrc
use xev(1) to find the key code of the buttons you want to change.

2025-05-01 23:54:58 UTC

- reply

wooohooo @npub17wv…nag2 made his first contrib in this #ghidriff release!

2025-04-05 15:30:14 UTC

The european commission is repackaging #chatcontrol as #protectEU - don't let them change the framing, never use #protectEU, always, always use #chatcontrol - do not let them take control of neither the chats, nor the discussion.

2025-03-27 17:52:25 UTC

- reply

i see your point, and i agree. but from a different perspective i also see that this project got a lot of scrutiny that it wouldn't have gotten otherwise, some skeletons were falling out of the closet, and that is good. maybe this is not the right way (quite possibly) but i think it is good if we all focus our attention from time to time on a project that is otherwise mature and forgotten because it just works.

2025-01-15 18:57:46 UTC

- reply

:/
> This user has requested that their content only be shown to signed-in users.

2025-01-06 16:29:08 UTC

wow. pretty cool, after #38c3 talk on how insecure the electronic healthcare records are, the minister for healthcare cancels the rollout until all weaknesses are fixed (which is impossible imo), https://x.com/Karl_Lauterbach/status/1875316946922770627 beware of link into nazibar...
edit: the german minister. this is a german thing. sadly, should be any eu country i believe

2024-12-28 22:01:28 UTC

- reply

is that the one in Budapest with gangsta Zolee and where MacLean takes down a helicopter with a car? Yippie Kee yay mf!

2024-12-25 13:05:30 UTC

- reply

i think that is an excellent question for @npub1fdr…lvhs or @npub1dnd…hzjs myself found libris.nl in the netherlands to be an association of b&m bookshops that has an online presence to be ok for my taste.

2024-11-11 14:50:17 UTC

#mac users, help! i'm going crazy, when you install #libsodium using #brew, it installs the library in /opt/homebrew/Cellar/libsodium/<version>/lib/libsodium.dylib but apparently not in /usr/lib or /usr/local/lib, so nothing finds it, and as a build script that has sodium as a dependency has to guess the versions and the path where brew installed the library. this makes no sense, what am i missing, and how is this supposed to work? what kind of madness is this?

2024-10-06 18:07:28 UTC

- reply

shiboleth?

2024-09-15 20:18:57 UTC

- reply

have you tried asciimoos omnom: https://github.com/asciimoo/omnom
i host an instance at https://links.ctrlc.hu/

2024-08-20 11:33:15 UTC

- reply

actually the inverters talk zigbee with a central APSystems ECU-R "information gateway" - some fine dutch people did most of the hard work reverse-engineering the protocol and providing nice homeassistant and openhab integration.

2024-08-20 11:29:07 UTC

- reply

our inverters have never been connected to the internet, there is absolutely no reason to do so. they are connected to a wifi AP that has no internet connectivity at all, so your phone app can still connect to them and do local management and looking at ugly telemetry. with a small (and non-consumer-grade python tooling i actually fake the cloud and stuff all the telemetry into grafana) and yes, all communication is cleartext and goes to china.... if i would let it.