wiktor-k

The server can get the calling process info [0], which may be useful for local access control. TCP sockets cannot distinguish clients like that.

[0]: https://docs.rs/tokio/latest/tokio/net/struct.UnixStream.htm...

AFAIR you can choose to use Windows OpenSSH or the other one during Git for Windows installation. [0]

[0]: https://duckduckgo.com/?q=git+for+Windows+openssh&t=fpas&iax...

SSH agent extensions are really powerful.

I'm maintaining a crate for writing own agents (and clients) and just recently added an example of providing decryption over extensions [0] which, coupled with the other examples, allows using SSH agent as a proxy between OpenPGP Card devices (eg Yubikeys) and OpenPGP encrypted data.

[0]: https://github.com/wiktor-k/ssh-agent-lib/pull/70

Got some really positive feedback about this one: https://chaos.social/@Foxboron/112416348981479022 ;)

> Windows didn't really do Unix sockets until recently so everything there is awful

Sadly the support for Unix sockets on Windows in Rust's standard lib is stuck in a limbo: https://github.com/rust-lang/libs-team/issues/271

Fortunately the built-in Windows' SSH client and agent work over Named Pipes and it's quite easy to communicate with them that way: https://github.com/wiktor-k/ssh-agent-lib#agent

Hmm... this is about PQ cryptography while I was expecting a status update of Ed25519 in WebCrypto which, sadly, is still available only via experimental platform flag: https://caniuse.com/mdn-api_subtlecrypto_verify_ed25519

Is it just me or should the following fragment use EnforcedAlignment in main?

    #[derive(TypeLayout, Copy, Clone)]
    #[repr(C)]
    struct EnforcedAlignment {
        _offset: [u8; GAP - 8],
        data: AlignedU128,
    }

    pub fn main() {
        println!("{}",  StockAlignment::type_layout());
    }

Excellent blogpost showing their product, by the way!

It gives me strong Amiga-vibes and it seems it's open-source now... I like it and will definitely try it out!

> Windows checks the code signing certificate of the exe, and if it isn't present and the binary not widely used shows you a big scary warning to discourage you from running it.

Actually even if the file is correctly signed but is new users will see the warning banners. (Unless using the more expensive EV Code Signing certs)

> Of course open source projects rarely sign their exes because those certificates are expensive ($300+/year).

I'm not sure where the $300/ year comes from but one can get valid certs for less than 50 EUR a year (https://shop.certum.eu/open-source-code-signing-on-simplysig...). I got a physical key one for 65 EUR and it worked just fine.

If the open source project is widely recognizable I'd suggest contacting https://signpath.org/ to get code signing for free (as in beer) via simple Github Action workflow.

Streaming is not a problem (it's just a simple flag: https://github.com/wiktor-k/llama-chat/blob/main/index.ts#L2...) but I've never used voice input.

The examples show image input though: https://github.com/ollama/ollama/blob/main/docs/api.md#reque...

Maybe you can file an issue here: https://github.com/ollama/ollama/issues

Ollama is simply great! I was quite surprised how easy it is to integrate through their API. A simple chat using Ollama + llama3 is less than 40 lines of TypeScript: https://github.com/wiktor-k/llama-chat

> I'm curious, what do you like about the Emacs key bindings? Is it the GNU system integration, like with Bash?

Nah, I actually don't use them I'm Bash that frequently.

It may be just due to the non-modal way of the hot keys. With Helix I frequently press Esc far too many times to be sure I'm in a right mode (just like I press C on a calculator a couple of times to clear it).

I've got caps remapped to control and somehow most of the shortcuts that I use quickly got into my muscle memory in a way that Helix's don't. I guess it's just hard for me to put into words why is that.

> The thing about Emacs isn't it's key bindings. It's the extensibility and integration of the overall system.

Well, I guess Emacs is many things to different people. After using Helix for quite some time the single thing I missed was exactly the Emacs keybindings. Not plugins, although I've used quite a lot of them.

> I wonder if it means that the author will stop working on the library after their next release,

Just FYI it seems the library will still be maintained: https://infosec.exchange/@firstyear/112337225055591544

Just to clarify Estonian Id-Card most certainly implements the PIV applet while Yubikeys implement both PIV and the OpenPGP Card (the latter has a benefit of natively supporting ed25519: https://github.com/wiktor-k/age-plugin-openpgp-card).

Linux most definitely has a TPM interface, it's called /dev/tpmrm0 and plenty of libraries for accessing it (eg. https://github.com/parallaxsecond/rust-tss-esapi/ full disclosure: I'm co-maintaining it). Systemd is not needed for that.

I had to use Windows machine to test an app recently and the amount of ads and other annoyances there is just mindblowing. I wanted to show Solitaire to my kids but it's so ad-ridden it's painful to play.

I'm strongly considering just reformatting the drive and putting Linux in there.

Sequoia aims to be a "complete gnupg replacement" but in many ways it's still the same mindset as gnupg (core devs are former developers of gnupg). Sequoia also got support from VCs and just recently received significant funding from the STF which gives them resources to polish the documentation etc.

Rpgp is much smaller but also very flexible. It's easy to adjust to more specific needs. It's also associated with RustCrypto project and with Rust in general.

For example to add rpgp to your project you just do "cargo add pgp". To use Sequoia "properly" you need this multiline setup which depends on whether your crate is a "leaf" crate or not: https://gitlab.com/sequoia-pgp/sequoia/-/tree/main/openpgp?r...

Another example: Sequoia is against rustfmt. This makes it harder to contribute.

On the other side rpgp is much more barebones and instead of docs you need to read the source (which is rather readable).

Both of them would benefit from a high level API, so that the users wouldn't have to work with types such as ValidUserAttributeAmalgamationIter (https://docs.rs/sequoia-openpgp/latest/sequoia_openpgp/cert/...).

Full disclaimer: I've worked 3 years on core Sequoia and I'm kind of involved in the OpenPGP protocol: https://github.com/wiktor-k

Yep, the schism is really bad for the end users and based on my "insider" knowledge it doesn't seem like the resolution is near.

The tl;dr is that GnuPG basically forked OpenPGP into https://librepgp.org/

It uses this crate: https://crates.io/crates/pcsc

On Windows and Mac it binds to system libraries. On Linux it works with pcsclite.

Btw I'm not aware of any tooling that's used by Sequoia, rather wrappers that use Sequoia and pcsc crate.

Indeed. There were some discussions over choosing MPL but the parent foundation was more aligned with GPL and after it collapsed it seemed th3 idea of relicensing to MPL was dropped.

Do note that sequoia and rpgp are different in many aspects so the licensing is just one thing.

I agree that gpg did not age well. If we compare it to a different project with similar history: curl, it's apparent that gpg chose wrong on several fronts. It should be a library first instead of a cli tool. Funny part is that even the library of gpg (gpgme) is internally calling the binary.

I've played around with designing a higher level library to OpenPGP once (https://pypi.org/project/pysequoia/) and personally I think it yields more readable, faster and secure code.

Yep. We've got it working with OpenPGP Card devices (Yubikeys, Nitorkeys, etc.). The signing part was actually pretty easy and the decryption required a bit more work but the maintainer was super responsive (https://github.com/rpgp/rpgp/pull/315).

Overall I'm pretty happy with the codebase.

The PoC for using cards in git is in https://github.com/wiktor-k/monkeybagel (excuse the silly name ;).

Rpgp is great (we're currently using it for a better git signer with smartcards) but I wonder why is it trending right now at HN? Maybe because it's currently #1 in the test suite? https://tests.sequoia-pgp.org/

SEEKING WORK

Location: Poland

Remote: Yes

Technologies: Rust, cryptography, HSMs, TypeScript, Docker recently but I have professional experience in all sorts of technologies

Résumé/CV: available on request, but see https://github.com/wiktor-k

Email: wiktor at metacode.biz

Hi, I'm a software engineer with 4 years of Rust experience working on open source crates for cryptography and security (co-maintaining TPM and PKCS#11 crates together with arm engineers; packages implementing the SSH protocol in Rust and TypeScript). Over 15 years of professional experience ranging from small JavaScript startups through enterprise Java applications for multinational corporations to highly regulated medical and aviation projects. MSc in CS.

Looking for interesting work opportunities!

Location: Poland

Remote: Yes

Willing to relocate: No

Technologies: Rust, cryptography, HSMs, TypeScript, Docker recently but I have professional experience in all sorts of technologies

Résumé/CV: available on request, but see https://github.com/wiktor-k

Email: wiktor at metacode.biz

Hi, I'm a software engineer with 4 years of Rust experience working on open source crates for cryptography and security (co-maintaining TPM and PKCS#11 crates together with arm engineers; packages implementing the SSH protocol in Rust and TypeScript). Over 15 years of professional experience ranging from small JavaScript startups through enterprise Java applications for multinational corporations to highly regulated medical and aviation projects. MSc in CS.

Looking for interesting work opportunities!

> OpenSSH certs are weird in that they include the signer's public key.

OpenSSH signatures in general contain signer's public key, which I personally think it's not weird but rather cool since it allows verifying the signature without out of the band key delivery (like in OpenPGP). The authentication of the public key is a separate subject but at least some basic checks can be done with an OpenSSH signature only.

Could you share what's the property name for the update url?

I've just tried a sample vcf and on my Samsung phone and it shows the URL field (https://codeberg.org/nfraprado/vcf-test/src/branch/pages/vca...) in the contact page. But not the other links. I'm not sure about the iOS contacts app.

Just for the record I've seen other providers giving routers with GPON SFP/XGS-PON SFP+ modules, which act as an ONT (see eg. https://www.play.pl/pomoc/naprawa-i-konfiguracja/telewizja-i...).

I'm not sure if they could be inserted into own equipment, though.

There's one issue with text, it defaults to ASCII:

> For example, for any MIME type whose main type is text, you can add the optional charset parameter to specify the character set used for the characters in the data. If no charset is specified, the default is ASCII (US-ASCII) unless overridden by the user agent's settings. To specify a UTF-8 text file, the MIME type text/plain;charset=UTF-8 is used.

See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_...

> Here's the first one I found that causes server<->server incompatibility: https://xmpp.org/extensions/attic/xe

What kind of incompatibilities does it cause? It's an unfinished spec for group chats, which, to my knowledge is barely implemented anywhere.

Just for the record I'm using both XMPP and Matrix daily and both have issues :/