Sign in

Thomas Ptacek

@sockpuppet.org
3K followers 220 following 1.1K posts

Full of passionate intensity.

PostsRepliesMedia
Thomas Ptacek @sockpuppet.org · 25/09/2026
Today I'm parting ways with fly.io. It's been a privilege. I'm off to tilt at a big old windmill with Kurt, again. sockpuppet.org/blog/2026/09...
sockpuppet.org
What Even Is An OS Now?
Computers now work the way I thought they did when I was 8. What does computing look like when most applications have an audience of 1-2 people? I'm leaving Fly.io to build a phone for that world.
81117
Thomas Ptacek @sockpuppet.org · 17/09/2026
I wrote a thingy. sockpuppet.org/blog/2026/09...
sockpuppet.org
How To Write With An LLM
Two rules keep an LLM from pasteurizing your writing: never take a word it suggests, and never let it encourage you. Then hand it all the tedious work.
0131
Thomas Ptacek @sockpuppet.org · 27/08/2026
This week on Security Cryptography Whatever.
1161
Thomas Ptacek @sockpuppet.org · 21/08/2026
I might have an RSS feed now. Let me know if it doesn't work. I vibe-shipped it.
180
Thomas Ptacek @sockpuppet.org · 21/08/2026
Current status
030
Thomas Ptacek @sockpuppet.org · 20/08/2026
I wrote a thingy. sockpuppet.org/blog/2026/08...
sockpuppet.org
Stop Making TUIs
10589
Thomas Ptacek @sockpuppet.org · 15/06/2026
It finally happened. We finally got @lcamtuf to hang out with us for an hour, to discuss bugnarok, a.k.a. bugsment day, f.k.a. the bugpocalypse. securitycryptographywhatever.com/2026/06/14/f...
securitycryptographywhatever.com
Facing the Vulnpocalypse With lcamtuf
We talk to Michał Zalewski (lcamtuf) about the vulnpocalypse and if we even need fuzzers anymore. This episode may be export controlled at a future date. Th...
0151
Thomas Ptacek @sockpuppet.org · 28/05/2026
What in the everloving fuck are these people thinking? A fucking car has a 16 year age floor.
3120
Thomas Ptacek @sockpuppet.org · 25/05/2026
If I was participating in a cryptography standards group and said something that caused an academic cryptographer to vocally question their support of formal methods, I would immediately take a 3 year sabbatical from computers and go work at Whole Foods or something.
0190
Thomas Ptacek @sockpuppet.org · 25/05/2026
So this is perfect. connections.audio
connections.audio
Audio Connections
020
Thomas Ptacek @sockpuppet.org · 21/05/2026
Blake Colquitt claims Hacker News is hospitable to "race realism" (because of Curtis Yarvin). We share most of an opinion about Yarvin, but he is making up that claim about HN. HN is distinctively INHOSPITABLE to that stuff, far more so than Bsky. www.dontbeasucker.blog/p/the-butter...
dontbeasucker.blog
The Butterflies in Your Stomach Are Planning a Coup
It only took 250 years for American elites to forget why they hated monarchy
150
Thomas Ptacek @sockpuppet.org · 21/05/2026
People meeting up at around 7PM at Kaiser Tiger on Ogden/Randolph for ChiSec, if you're bored and want to drink with nerds. No RSVPs, just show up.
020
Thomas Ptacek @sockpuppet.org · 21/05/2026
Very much enjoying watching nerds attempt to cancel Olga Tokarczuk for acknowledging she used LLMs in her brainstorming process. Nobelslop!
050
Reposted by Thomas Ptacek
llimllib @billmill.org · 12/05/2026
(good article, I wish I could have clicked on the images to view them full size) I also made a markdown renderer that works exactly like I want, because I was unhappy with glow: github.com/llimllib/mdr...
github.com
GitHub - llimllib/mdriver: A streaming markdown printer
A streaming markdown printer. Contribute to llimllib/mdriver development by creating an account on GitHub.
121
Thomas Ptacek @sockpuppet.org · 12/05/2026
I wrote a thing. This is not a love letter to Emacs, which is one of my more toxic and codependent relationships. sockpuppet.org/blog/2026/05...
sockpuppet.org
The Emacsification of Software
3405
Thomas Ptacek @sockpuppet.org · 16/04/2026
Oh, ChiSec is tonight, bunch of security nerds hanging around at a bar, Kaiser Tiger on Randolph/Ogden, 7PM. No RSVPs, just show up, look for the table of nerds. Has been pretty well attended lately.
040
Thomas Ptacek @sockpuppet.org · 16/04/2026
Skyr is the king of all dairy products, that is all.
081
Thomas Ptacek @sockpuppet.org · 14/04/2026
Alex Gaynor on the "sufficiently smart compiler" of software security, the mythical actually-effective static analyzer: alexgaynor.net/2026/apr/13/...
alexgaynor.net
If it could have, why didn't it? · Alex Gaynor
0134
Thomas Ptacek @sockpuppet.org · 11/04/2026
This is a fucking incredibly great bug. Ask Claude to demonstrate it for you; it'll one-shot it. For ECC signatures (at least), WolfSSL thinks a 1-byte SHA2 hash is just as good as a 32-byte hash.
1532
Thomas Ptacek @sockpuppet.org · 30/03/2026
I wrote something: sockpuppet.org/blog/2026/03...
sockpuppet.org
Vulnerability Research Is Cooked
79639
Reposted by Thomas Ptacek
Deirdre Connolly¹ ² @durumcrustulum.com · 27/03/2026
Cryptographer Matt Green as God Emperor Leto II
2111
Thomas Ptacek @sockpuppet.org · 27/03/2026
Yeah, so, I'm going to have more to say about this later, but, for now... yeah. securitycryptographywhatever.com/2026/03/25/a...
securitycryptographywhatever.com
AI Finds Vulns You Can
Returning champion Nicholas Carlini comes back to talk about using Claude for vulnerability research, and the current vulnpocalypse. It’s all very high-brow ...
2135
Thomas Ptacek @sockpuppet.org · 14/03/2026
Extremely psyched about two upcoming SCW guests, one of them this week. We've got very crunch vulnerability research and cryptography stuff coming.
0243
Thomas Ptacek @sockpuppet.org · 10/03/2026
Y'all, I've seen some shit, but I've never seen someone want *both* DNSSEC ceremonies *and* the CA/B Forum before.
3140
Thomas Ptacek @sockpuppet.org · 04/03/2026
Nicholas Carlini at [un]prompted. If you know Carlini, you know this is a startling claim.
1343
Thomas Ptacek @sockpuppet.org · 28/02/2026
None of you are giving me enough credit for not participating on the TLS working group mailing list. You're welcome. Everything I don't do, I don't do it for you.
2262
Thomas Ptacek @sockpuppet.org · 26/02/2026
Annals of things people have actually written down for other people to read: "No one trusts NIST. But people do trust the IETF."
050
Thomas Ptacek @sockpuppet.org · 25/02/2026
People who hope to apply Daniel Bernstein's rules-lawyering tactics at IETF, which were honed in the DNS WGs (where he was probably in the right), would do well to remember that those tactics have consistently failed. They've merely won him standing to complain about the IETF.
030
Thomas Ptacek @sockpuppet.org · 25/02/2026
There's only one correct way forward for handling the introduction of MLKEM into TLS, and, indeed, all future tls-wg cryptography debates, and it's this proposal: snkth.com/add-crypto/
snkth.com
Additive Cryptography for TLS
This document defines Additive Cryptography for TLS, a transition framework in which algorithms are never replaced and only accreted. Implementations MUST NOT negotiate a single key exchange algorithm...
1202
Thomas Ptacek @sockpuppet.org · 23/02/2026
Given how i am only a) a beneficiary of air travel (thanks for all the miles so far) b) A non-avionics-expert reader of the EUROCAE WG-128 RTCA/DO-254 drafts c) A spectator usually attending this type of debate with popcorn I hope my comments are useful...
040
Thomas Ptacek @sockpuppet.org · 22/02/2026
"Auchentoshan" is inarguably the best distillery name.
041
Thomas Ptacek @sockpuppet.org · 18/02/2026
Very fun: if you have the dictionary of embeddings Semantle uses, solving it is a trivial linear algebra problem: they're giving you the cosine similarity back on every guess, so you can filter out most of the vocabulary on a single guess. victoriaritvo.com/blog/semantl...
victoriaritvo.com
A Solver for Semantle
1110
Thomas Ptacek @sockpuppet.org · 17/02/2026
For a lot of years I was in the habit of criticizing cryptography designs that used asymmetric constructions because RSA is much more complicated and hard to get right than symmetric crypto. But the real problem is that it's against the law to authenticate an RSA key.
281
Reposted by Thomas Ptacek
Coda @codahale.com · 17/02/2026
Seriously, every paper with Backendal as an author is a banger
251
Thomas Ptacek @sockpuppet.org · 17/02/2026
"presenting a cornucopia of practical attacks". These are my favorite words ever to have occurred in a cryptography paper.
3549
Reposted by Thomas Ptacek
Chris Gale @m0nastic.bsky.social · 05/02/2026
I think even calling it Chess is being charitable; many days I think it's closer to the board game Concentration.
011
Thomas Ptacek @sockpuppet.org · 05/02/2026
Of all the possible LLM applications to be skeptical about, vulnerability research seems like it has to be the dumbest. Of course it works. If you think it can't, I'll assume you've never once billed an hour looking for vulnerabilities.
4261
Thomas Ptacek @sockpuppet.org · 30/01/2026
JAMC sounds absolutely nothing like Echo & The Bunnymen. That is all.
020
Thomas Ptacek @sockpuppet.org · 29/01/2026
Peak vertical video food content. I am officially wearing an onion around my belt. It is the fashion of my time.
020
Thomas Ptacek @sockpuppet.org · 28/01/2026
Just recorded the premiere episode of Season VIII of Security Cryptography & W/evs, this time with Alex Gaynor and Paul Kehrer, who have a momentous announcement about pyca/cryptography and OpenSSL.
2243
Thomas Ptacek @sockpuppet.org · 17/01/2026
This is a perfect piece of technical writing. alexharri.com/blog/ascii-r...
alexharri.com
ASCII characters are not pixels: a deep dive into ASCII rendering
A look at how I used shape vectors to achieve sharp, high-quality ASCII rendering.
214845
Thomas Ptacek @sockpuppet.org · 15/01/2026
Quick reminder that ChiSec is tonight, it's at Kaiser Tiger now (on Ogden in West Loop), starts at 7PM, no RSVPs just show up, I'll probably make it by around 8PM.
020
Thomas Ptacek @sockpuppet.org · 15/01/2026
I wrote a thing. fly.io/blog/design-...
fly.io
The Design & Implementation of Sprites
So that we may educate as well as horrify: the internals of our new Sprites execution platform.
092
Thomas Ptacek @sockpuppet.org · 31/12/2025
Final SCW of 2025! We had Matt Bernhard on to talk about cryptographic voting systems, in the wake of the IACR election. (Everybody I voted for in the new election won! Woo!)
093
Thomas Ptacek @sockpuppet.org · 26/12/2025
Rust people should be embarrassed by the people trying to argue that Rust is the only truly memory-safe mainstream language. Far and away the cringiest RESF trope.
4111
Thomas Ptacek @sockpuppet.org · 13/12/2025
They should use Vince Guaraldi's instrumenal Joe Cool diagnostically. If you can hear it and not at some point grin, something's clearly wrong.
040
Thomas Ptacek @sockpuppet.org · 20/11/2025
Quick reminder that ChiSec is tonight at 7PM. It's at Kaiser Tiger, at Randolph and Ogden (just down the street from where Twisted Spoke was).
010
Thomas Ptacek @sockpuppet.org · 13/11/2025
No he didn't. He said other bad shit, which isn't reported here because it's not as exciting as the made-up shit. Shun accounts that do this.
050
Thomas Ptacek @sockpuppet.org · 09/11/2025
Three dumb ideas that recur constantly in discussions among nerds about intelligence: (1) IQ tests are illegal in hiring. (2) There exist national average IQ numbers. (3) Intelligence research is suppressed.
5203
Thomas Ptacek @sockpuppet.org · 06/11/2025
I wrote a thing, about a project you should knock out when you get 45 minutes free. fly.io/blog/everyon...
fly.io
You Should Write An Agent
They're like riding a bike: easy, and you don't get it until you try.
0234