kpcyrd 🏳️‍🌈🏴

Rust Developer 🦀, {Arch Linux,Debian,Alpine} Package Maintainer 📦, Reproducible Builds Enthusiast ⛓, Security Researcher 🦝, Anarcho Communist 🏴

Public Key

npub10dsewkt83a3h3r3vdqprnvw4u9vw74q9uhvj757smgtyl55p4thqanlp0c

NIP-05 Address

kpcyrd@chaos-social.mostr.pub

Profile Code

nprofile1qqs8kcvht9nc7cmc3ckxsq3ek827zk802sz7tkf020gd59j062q64mspz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsyfza2n

Publishing to

yabu.me

relay.damus.io

nos.lol

Author Public Key

npub10dsewkt83a3h3r3vdqprnvw4u9vw74q9uhvj757smgtyl55p4thqanlp0c

Show more details

Last Notes

2026-10-20 23:34:10 UTC

This week, two days in, we have a major bank being down the entire day, the private keys of a CA recovered and posted all over the internet, and 281 GB of internal emails of the German far-right party leaked, talking about processing refugees into boots and handbags.
I hate this timeline, GTA 6 better be good.

2026-10-20 20:32:52 UTC

Fortunately, in 2026, we have SBOMs for everything so we can trivially tell which computers and software trusts #eMudhra and which ones needs their ca-certificates updated urgently~
The private keys have been recovered independently by multiple researchers, certificate transparency is rarely enforced client side, so TLS is going to be broken to the point of "accepts any self-signed certificate" in many cases, likely very soon.

2026-07-30 21:59:53 UTC

- reply

@nprofile…6z3g nice one, congrats! 🔥 :3 in case it's your first one, using sun screen (even in regular weather) helps keeping the color crisp.

2026-07-26 18:03:21 UTC

- reply

@nprofile…6z3g @nprofile…ueza congrats on the tattoo! 🖋️

2026-07-14 12:25:33 UTC

- reply

@nprofile…gr74 I package Cloudflare's wrangler+workerd stack, wrangler is typescript and depends on turbo to build, which in turn has a dependency on libghostty-vt-sys, which in turn tries to invoke a zig compiler, than fails (that's why rust and zig error messages are mixed in the screenshot).

2026-07-14 11:55:42 UTC

I wish people would avoid #zig for software that is packaged in distributions. The zig standard library is pre-1.0, meaning zig software is always written for a specific compiler version that Arch Linux build servers may not be able to match.
This specific error seems to come out of ghostty's build system though instead of zig itself: https://github.com/ghostty-org/ghostty/blob/55a3e33ab26a23d75b274b23c7f76d837db00578/src/build/zig.zig
https://assets.chaos.social/media_attachments/files/116/918/152/257/051/826/original/74cb7ff9ae2fb47a.png

2026-06-17 22:52:54 UTC

Why do people pretend C is a significantly more mature ecosystem yet here I am with "make 4.4.1 doesn't compile anymore because C23 added a new function to the standard library and the make C code from 3 years ago is now invalid".
#rust #linux

2026-01-23 01:15:32 UTC

- reply

@nprofile…m0rx I think it's more a "how did you install your dependencies" - if you install python-cryptography with apt/pacman you get pre-compiled binaries and no Rust compiler is needed.
If you use `pip install` it downloads source code from pypi.org (crates.io for python) and then needs the relevant compilers for any FFI modules
But Rust essentially is compatible with more devices than Python, so I'm not sure what the concern is? Would you be equally bothered by the need for a C compiler?

2025-12-28 11:19:21 UTC

- reply

@nprofile…84gr @nprofile…6t7p Arch Linux has their own public key authentication/identification processes anyway, just publish a signed list which maintainer is which public key, we don't actually need a baked in web3-like cryptographic-identity system.
If anything, tying "this MPI is my identity" too closely is the reason why many maintainers haven't rotated their signing key in 10+ years. #39c3

2025-12-27 19:59:21 UTC

- reply

@nprofile…v83l @nprofile…wjds which one is the unresolved sequoia issue?

2025-12-27 19:51:51 UTC

- reply

@nprofile…v83l works for me, @nprofile…lahz might know more

2025-12-27 17:54:34 UTC

- reply

@nprofile…v83l Debian/apt has already switched to sequoia for their next release.
Dropping OpenPGP entirely is tricky because there's a strong push for hardware signing keys, and that market is PGP only. 💔

2025-11-23 20:27:56 UTC

I've published a writeup about the ongoing `hashFiles` incident on #Github Actions:
https://lists.reproducible-builds.org/pipermail/rb-general/2025-November/003941.html
#supplychainsecurity #infosec

2025-05-26 15:44:29 UTC

- reply

@nprofile…4lh8 maybe it's time for gentoo to join Reproducible Builds? :) These security concerns have been proven to be very solvable for many years (by Arch Linux and Debian), even without having everybody compile their own compiler.

2025-05-24 16:01:04 UTC

- reply

@nprofile…h72q that's pretty cool! are the absolute numbers available somewhere? since Arch doesn't keep track of how many users there are, maybe this could be the next best thing to get an idea of how many there might be (in the desktop space).

2025-05-04 16:13:50 UTC

- reply

@nprofile…j5lu @nprofile…ra2c "Progress on securing [...]" idk, seems accurate to me

2025-05-04 14:35:46 UTC

- reply

@nprofile…j5lu @nprofile…ra2c Reproducible builds is more of a "nothing up my sleeve" technique, and if multiple independent parties have successfully reproduced all your binaries, this means if there's a backdoor, you can find it by reading the source code (ignoring the trusting trust and collusion problem for now).
Reproducible builds is not that useful for "finding abuse", but "closing one vector for abuse in entirety". This kind of systemic improvement is extremely rare in computer security.

2025-05-04 14:26:54 UTC

- reply

@nprofile…j5lu @nprofile…ra2c hello! I'm the developer of some of the mentioned tools and spent ~7 years in this space, so probably somewhat qualified to answer:
There is no "the one supply-chain security problem", it's multiple. Reproducible builds gives you guarantees about the binaries you put into your computer, it obviously doesn't fix the lack of source code review efforts. The Rust ecosystem has cargo-crev to defeat Jia Tan style attacks, but the overall opensource community doesn't.

2025-02-19 23:22:06 UTC

- reply

@nprofile…h9tf @nprofile…3wua well hello, is this the "map lat/lon to ratatui map" code I was looking for? 👀

2024-12-10 11:17:09 UTC

- reply

@nprofile…w6yj @nprofile…4j8n it's run by archlinux.de, but the data is used by many archlinux.org people (among others)

2024-05-02 13:30:00 UTC

Provenance data. There you have it. https://whatsrc.org/artifact/sha256:981a75f8291020d9f6632c6160ee3651f376bdf354373bea00506a220e355134
Quite often there's established consensus about "what's the source code", no need to make opensource developers go web3.
The problem at hand is how we have zero data about who claims to have code reviewed this.
https://assets.chaos.social/media_attachments/files/112/371/669/390/071/656/original/0e72c86fedfdd26b.png