iiinova — where your digital self keeps evolving

dr.-ing. ⁡jaseg @jaseg.chaos.social.ap.brid.gy · 24/10/2026

@mntmn I’ve used a chip like this a while ago for a prop. They’re a really cheap and easy way to avoid having to get a USB library working in one-off projects. It’s basically a reflowable USB HID stack.

000 0

Reposted by dr.-ing. ⁡jaseg

Rohini Lakshané @rohini.mastodon.social.ap.brid.gy · 22/10/2026

Because eMudhra is in the news, I am sharing a screenie of a footer of an email I once received from them in reply to my query about my PAN card (a government-issue tax identity and card).

133770 337

dr.-ing. ⁡jaseg @jaseg.chaos.social.ap.brid.gy · 23/10/2026

I'm cooking up some new layout code for kimesh[1] that can comply with arbitrary board shapes better, and at lower trace/space settings :) [1] jaseg.de/projects/kimesh

A 2D plot of an organic looking layout of lines that fill the image without touching. The lines are split into three color-coded zones with irregular, jagged borders between them.

101 1

Reposted by dr.-ing. ⁡jaseg

abadidea @0xabad1dea.infosec.exchange.ap.brid.gy · 22/10/2026

“It’s a poor worksman who blames his tools” has always been complete nonsense. No-one complains about imperfect tools faster and louder than a master. A master will yank a cheap or damaged tool out of your hand and yell at you for not blaming it yet Cheap, lousy tools come from middle managers […]

infosec.exchange

Original post on infosec.exchange

116889 89

dr.-ing. ⁡jaseg @jaseg.chaos.social.ap.brid.gy · 21/10/2026

instead of stealing mathematicians’ toys maybe openai should spend some tokens on that lol

000 0

dr.-ing. ⁡jaseg @jaseg.chaos.social.ap.brid.gy · 21/10/2026

Given the general state of affairs, I am calling for a rewrite of the php interpreter and standard library in rust.

101 1

Reposted by dr.-ing. ⁡jaseg

Sophie Schmieg @sophieschmieg.infosec.exchange.ap.brid.gy · 21/10/2026

This press release is gold: emudhra.com/en/press-release/emudhr… "Last weekend, an independent researcher found that the weak keys could be reverse-engineered possibly with AI-assisted techniques." Your private key was the number 4 […]

infosec.exchange

Original post on infosec.exchange

71958 58

Reposted by dr.-ing. ⁡jaseg

xssfox (crossy) @xssfox.cloudisland.nz.ap.brid.gy · 21/10/2026

Fyi, if you have a risky patch, deploy, infra change, today's the day to do it. You can pretty much get away with anything. Don't waste this opportunity.

3625 25

Reposted by dr.-ing. ⁡jaseg

abadidea @0xabad1dea.infosec.exchange.ap.brid.gy · 21/10/2026

I have a headache after trying to understand someone's blatantly Claude-generated writeup of the PHP bug. It's like dazzle camouflage for useful information

0167 16

Reposted by dr.-ing. ⁡jaseg

🇨🇦Samuel Proulx🇨🇦 @fastfinge.fed.interfree.ca.ap.brid.gy · 20/10/2026

Hey, fediverse: Do I know anyone working on the Windows Store over at Microsoft? I'd like to publish an app to the Windows Store; unfortunately: * the ID verification process for a personal developer account requires taking live photos and scanning QR Codes, and I can't get through it with a […]

fed.interfree.ca

Original post on fed.interfree.ca

0012 12

Reposted by dr.-ing. ⁡jaseg

210561 ✨ [Q] @q.glauca.space.ap.brid.gy · 20/10/2026

If anyone wants to put the eMudhra private key on a T-Shirt: -----BEGIN EC PRIVATE KEY----- MA8CAQEEAQSgBwYFK4EEACI= -----END EC PRIVATE KEY-----

411958 119

Reposted by dr.-ing. ⁡jaseg

Matt Blaze @mattblaze.federate.social.ap.brid.gy · 11/10/2026

@sophieschmieg Pay PhD students more, and have career prospects for them when they finish.

103 3

Reposted by dr.-ing. ⁡jaseg

Sophie Schmieg @sophieschmieg.infosec.exchange.ap.brid.gy · 11/10/2026

"but AI is good at math now!" Yeah, you know who else is good, arguably even a lot better at math? Humans. Volume in proved statements isn't going to get you the type of complexity theory shattering results that you'd need to break public key cryptography. Yes AI is advancing at fast speeds […]

infosec.exchange

Original post on infosec.exchange

106 6

dr.-ing. ⁡jaseg @jaseg.chaos.social.ap.brid.gy · 20/10/2026

A quick back of the envelope calculation says that if you're unemployed enough, you might be able to finish calculating a signature by hand by the beginning of #40c3 this december. I'm sure that would get a slot in the art track!

000 0

dr.-ing. ⁡jaseg @jaseg.chaos.social.ap.brid.gy · 20/10/2026

Everybody is mad about the eMudhra TLS CA intermediate compromise. But let's say it as it is: In an age of AI taking over, eMudhra is out there fighting for team human, and unlocking your ability to finally remember TLS keys without the need for a machine! With their groundbreaking technology […]

chaos.social

Original post on chaos.social

104 4

dr.-ing. ⁡jaseg @jaseg.chaos.social.ap.brid.gy · 20/10/2026

Big CA uses the number four, as in literally “4” as the private key for one of their intermediates like in the fucking xkcd was not on my bingo card for 2026

297 9

dr.-ing. ⁡jaseg @jaseg.chaos.social.ap.brid.gy · 20/10/2026

@q it’s fucking literally that one xkcd wtf

the chosen by fair dice roll xkcd showing c code:

int get random number return 4, comment chosen by fair dice roll guaranteed to be random

252 5

Reposted by dr.-ing. ⁡jaseg

210561 ✨ [Q] @q.glauca.space.ap.brid.gy · 20/10/2026

4 times the SECP384-R1 base point is `(0x138251cd52ac9298c1c8aad977321deb97e709bd0b4ca0aca55dc8ad51dcfc9d1589a1597e3a5120e1efd631c63e1835, 0xcacae29869a62e1631e8a28181ab56616dc45d918abc09f3ab0e63cf792aa4dced7387be37bba569549f1c02b270ed67)` repository.emsign.com/certs/roottls… […]

glauca.space

Original post on glauca.space

124 4

dr.-ing. ⁡jaseg @jaseg.chaos.social.ap.brid.gy · 20/10/2026

(1) how do you fuck up this bad as a CA (2) what exactly were their auditors doing when they signed off on their baseline requirements compliance

000 0

dr.-ing. ⁡jaseg @jaseg.chaos.social.ap.brid.gy · 20/10/2026

hah, it wasn’t a compromise of their infra, it’s way, way worse: apparently somehow, SOMEHOW those intermediates’ private keys had like eight bytes of entropy…between the eight of them, total 🤯

101 1

dr.-ing. ⁡jaseg @jaseg.chaos.social.ap.brid.gy · 20/10/2026

This means that against a physical attacker, FIPS 140-2 level 3 literally only means "we glued the server shut really well", and all that's needed to get inside is a drill or an angle grinder.

100 1

dr.-ing. ⁡jaseg @jaseg.chaos.social.ap.brid.gy · 20/10/2026

There's an interesting detail in that screenshot that's hard to notice to a layperson: They say their HSMs are FIPS 140-2 level 3. FIPS 140-2 has four levels, and what most don't know is that only at level 4, the highest level, is any serious active tamper sensing required. At level 3, which […]

chaos.social

Original post on chaos.social

100 1

dr.-ing. ⁡jaseg @jaseg.chaos.social.ap.brid.gy · 20/10/2026

On the eMudhra CA certificate compromise: I just saw they advertise how they store their intermediate certs in HSMs on their website. There is a PoC of signatures from these keys making the rounds, which illustrates pretty well what the limits of HSMs are: To a […] [Original post on chaos.social]

Website screnshot with about one paragraph worth of text reading:

```
FIPS‑Certified HSM Deployment

Root & Intermediate CAs in HSMs
Offline Root HSMs: Air‑gapped, FIPS 140‑2 Level 3 modules hold root‑CA private keys, used only for signing intermediate‑CA certificates.
Online Issuing HSM Clusters: FIPS 140‑2 Level 3 modules in high‑availability clusters host intermediate and issuing CA keys for SSL/TLS, code‑signing, and client‑auth certificates.

```

102 2

dr.-ing. ⁡jaseg @jaseg.chaos.social.ap.brid.gy · 20/10/2026

Ist gerade irgendwas im Internet kaputt? Ich hab im Moment irgendwie sehr lange Ladezeiten bei bestimmten Webseiten, wenn ich über meine Telekom 5G-Verbindung unterwegs bin.

000 0

Reposted by dr.-ing. ⁡jaseg

Gabriele Svelto @gabrielesvelto.mas.to.ap.brid.gy · 31/07/2025

We are modernizing the user interface Pray we do not modernize it further

459186 186

Reposted by dr.-ing. ⁡jaseg

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 20/10/2026

"Ignoring the slop" cannot be done and it doesn't help. These reports created with the help of AIs point out actual problems, and sometimes vulnerabilities. Ignoring real vulnerabilities because they were found by AI does not make users safe and secure. It makes them vulnerable. We don't want […]

mastodon.social

Original post on mastodon.social

2253 25

Reposted by dr.-ing. ⁡jaseg

✧✦Catherine✦✧ @whitequark.treehouse.systems.ap.brid.gy · 15/10/2026

partly as a result of this, my software is frequently described as "the only thing that 'just works'" or variations on it. through the combination of controlling what i can, and removing as many pieces that i can't control, i end up with a very predictable result

236 6

dr.-ing. ⁡jaseg @jaseg.chaos.social.ap.brid.gy · 19/10/2026

For a demo of my Ashen open source HSM software stack at @PrototypeFund, I made a giant escape button that lights up. It’s modelled in FreeCAD and it uses an actual scaled-up Cherry MX keyboard switch. #electronics #3dprinting

A single red escape key scaled to about 10cm size sitting on a yellow/black earring colored base

The inside, showing the underside of a ridiculously large mx key switch

The bottom of the key case with a push pull connector on the side, rubber feet, and a camera thread mount.

202 2

dr.-ing. ⁡jaseg @jaseg.chaos.social.ap.brid.gy · 19/10/2026

it took so much self control to not name this paper “squiggles SQUIGGLES Squiggles A Field Survey Of Security Squiggles”

A two layer security mesh on a transparent flexible foil glued to the inside of a black injection molded plastic cover

An orange polyimide FPC security mesh glued to the inside of a cast zinc lid

A black carbon trace security mesh with a thermogormef cavity that has enlarged traces around its sides

000 0

dr.-ing. ⁡jaseg @jaseg.chaos.social.ap.brid.gy · 19/10/2026

do boosts count as citations or does it have to be a quote post to count? #science

001 1

dr.-ing. ⁡jaseg @jaseg.chaos.social.ap.brid.gy · 19/10/2026

the beatsaber modding scene is built on computer crimes. I recently learned that the "native arm64 beatsaber port" is done by taking an x86 beatsaber build, dissecting it, then combining its C# assemblies with a binary arm64 unity runtime from somewhere else and some patched, built-from-source […]

chaos.social

Original post on chaos.social

010 1

dr.-ing. ⁡jaseg @jaseg.chaos.social.ap.brid.gy · 18/10/2026

I’m on a walk right now and I just saw a particularly chonky ambulance drive past. It turns out it’s one of Berlin’s mobile stroke units. They have an on-board CT and laboratory machines for doing bloodwork so they can diagnose a stroke and start medication during transport to the hospital. It’s […]

chaos.social

Original post on chaos.social

100 1

dr.-ing. ⁡jaseg @jaseg.chaos.social.ap.brid.gy · 18/10/2026

Following up on the research in that paper, I'm now building an open source HSM toolkit in the Prototype Fund-funded Ashen software and nlnet-funded Yanartas hardware projects. News on these will appear on yasec.de/projects

yasec.de

Projects | yasec | Hardware Security Engineering

101 1

dr.-ing. ⁡jaseg @jaseg.chaos.social.ap.brid.gy · 18/10/2026

I've got a new paper coming out in TCHES 2027/1 titled "Tamper Sensing Meshes in Payment Terminals and Beyond". For the paper, I took apart ~30 payment terminals and other "secure" devices to find out how they build their security meshes. Based on that, I create […] [Original post on chaos.social]

A figure from a paper showing photos of seven payment terminals and one gambling machine processor module before and after disassembly.

Two figures from a paper, labelled "Construction styles used to cover 3D volumes using sandwich-style construction" and "Formed cavities in printed foil mesh in specimen H24". The figures have a total of six sub-figures showing different details of PCBs and security mesh foils.

105 5

Reposted by dr.-ing. ⁡jaseg

Scary "Grampus" Jerry 👻 @jerry.infosec.exchange.ap.brid.gy · 17/10/2026

There are major account take-over problems happening right now on mastodon instances - all appearances are that the actor is using stolen passwords, probably from malware running on desktops. I've suspended hundreds of compromised accounts over the past 48 hours, but only two on mine. If you […]

infosec.exchange

Original post on infosec.exchange

133 3

dr.-ing. ⁡jaseg @jaseg.chaos.social.ap.brid.gy · 17/10/2026

it’s nice to see that i didn’t get completely rusty during my extended break from beatsaber :)

010 1

dr.-ing. ⁡jaseg @jaseg.chaos.social.ap.brid.gy · 17/10/2026

@hey.paris that would be the perfect shader for a CAD tool

010 1

Reposted by dr.-ing. ⁡jaseg

Ludic 🧛 @ludicity.mastodon.sprawl.club.ap.brid.gy · 17/10/2026

The amount of financial anxiety I can suddenly detect permeating the people I know in the AI sector gives me the strength to go on I have avoided commenting on speculating on when we're nearing Peak Bubble for the past two years, and I still probably wouldn't do it in the press, but by pure […]

mastodon.sprawl.club

Original post on mastodon.sprawl.club

000 0

Reposted by dr.-ing. ⁡jaseg

YinYin Falcon @yinyinfalcon.mastodon.online.ap.brid.gy · 17/10/2026

I like the gallery on one of my commutes

"fuck AI I painted this with my own hands!" clean white text on a colourful square between two other pieces on a graffiti wall

014 4

dr.-ing. ⁡jaseg @jaseg.chaos.social.ap.brid.gy · 16/10/2026

the new controllers are such an upgrade over the index ones for beatsaber. they’re sooo much lighter!

100 1

dr.-ing. ⁡jaseg @jaseg.chaos.social.ap.brid.gy · 16/10/2026

@tamme You might also enjoy the work @azonenberg did hooking up an FPGA to a slightly chonky ST microcontroller through one of its external memory interfaces. It’s a separate chip, but it’s an approach that allows you to choose a size-appropriate FPGA that has an open source toolchain.

110 1

dr.-ing. ⁡jaseg @jaseg.chaos.social.ap.brid.gy · 16/10/2026

@tamme Zynq XC7Z010 might be an option. They’ve become really cheap these days, and while they have chonky application CPUs intended to run Linux, nothing stops you from just skipping that, disabling caches, and running your own code single-threaded on the bare metal on one of these. The FPGA […]

chaos.social

Original post on chaos.social

100 1

Reposted by dr.-ing. ⁡jaseg

Sophie Schmieg @sophieschmieg.infosec.exchange.ap.brid.gy · 16/10/2026

Finally, a good use case for an LLM: sort brute force search phrases by likelihood, in order to finally lay to rest one stupid conspiracy theory. I think @filippo had something on this? www.anthropic.com/research/ecdsa-cu…

anthropic.com

Claude reveals ECDSA curve origins

The decades-old mystery of the origins of one of the most popular cryptographic standards has been explained.

2237 23