eupolicy.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
This Mastodon server is a friendly and respectful discussion space for people working in areas related to EU policy. When you request to create an account, please tell us something about you.

Server stats:

245
active users

#secure

2 posts2 participants1 post today

Daniel J. Bernstein (#djb, to those who know and love him [1]) has a new blog entry about the NIST post-quantum #cryptography standardization process that's been ongoing for some years. Also, follow him @djb .

If you're not aware of some of the controversy about how NIST is running this process, it's a must-read.

blog.cr.yp.to/20250423-mceliec

My $0.02: it sure looks like NIST is backstopping an attempt by the NSA to get everyone to standardize on cryptography #standards that the #NSA knows how to break.

Again.

Yes, they did it before. If you read up on the Dual_EC calamity and its fallout, and how this time it was supposed to be different - open, transparent, secure - then prepare to be disappointed. NIST is playing #Calvinball with their rules for this contest, yanking the rug out from under contenders that appear to be more #secure and better understood, while pushing alternatives that are objectively worse (#weaker encryption, less studied, poorer #performance).

Frankly, I think organizations outside of the #USA would be foolish to trust anything that comes out of #NIST's current work. Well, those inside the USA too, but some of those may be forced by law to use whatever NIST certifies.

[1] Some people think djb is "prickly", not lovable. Oddly, it seems that the only people who say this are those who are wildly incorrect about code/algorithms and are being gently but publicly corrected about by djb at the time

blog.cr.yp.tocr.yp.to: 2025.04.23: McEliece standardization

Selhosted P2P E2EE File Transfer & Messaging PWA

* #OpenSource
* #CrossPlatform
* #PWA
* #iOS, #Android, #Desktop (self compile)
* App store, Play store (coming soon)
* Desktop
* #Windows, #MacOS, #Linux (self compile)
* run `index.html` on any modern #browser
* #Decentralized
* #Secure
* #NoCookies
* #P2P #encrypted
* No registration
* No installing
* #Messaging
* Group Messaging (coming soon)
* Text Messaging
* #Multimedia Messaging
* #Screensharing (on desktop browsers)
* Offline Messaging (in #research phase)
* #FileTransfer
* #VideoCalls
* #DataOwnership
* #SelfHosted
* GitHub pages Hosting
* #LocalOnly storage

Check it out!

positive-intentions.com

(Degoogled links to the apps)
- Chat: chat.positive-intentions.com
- File: file.positive-intentions.com
- GitHub: github.com/positive-intentions

Replied in thread

@evangreer @fightforthefuture.org @bsky.app @guardianproject
🆘 Ripple: Panic button for emergencies.
Trigger a #secure wipe, disguise apps, or alert trusted contacts. Useful when you’ve only got a few seconds to react. Essential for border crossings, raids, or detainment.
guardianproject.info/apps/info

Guardian ProjectRipple: respond when panickingTrigger apps to protect your privacy when in anxious or panic situations

Did you know that #GNU/ #FSF has its own #darknet application and protocol stack?

What is #GNUnet?

GNUnet is an
#alternative #network stack for building #secure, #decentralized and #privacy-preserving #distributed applications. Our goal is to replace the old insecure Internet protocol stack. Starting from an application for secure #publication of #files, it has grown to include all kinds of basic protocol components and applications towards the creation of a GNU internet.

Today, the actual use and thus the social requirements for a global network differs widely from those goals of 1970. While the Internet remains suitable for military use, where the network equipment is operated by a command hierarchy and when necessary isolated from the rest of the world, the situation is less tenable for civil society.

Due to fundamental Internet design choices, Internet traffic can be misdirected, intercepted, censored and manipulated by hostile routers on the network. And indeed, the modern Internet has evolved exactly to the point where, as Matthew Green put it, "the network is hostile".

We believe liberal societies need a
#network #architecture that uses the #anti-authoritarian #decentralized #peer-to-peer paradigm and #privacy-preserving #cryptographic #protocols. The goal of the GNUnet project is to provide a Free Software realization of this ideal.
https://www.gnunet.org/en/index.html
www.gnunet.orgGNUnetGNU's framework for secure p2p networking
Replied in thread

@bohwaz @punkfairie @ajsadauskas @JessTheUnstill @tomiahonen That's exactly the problem, cuz #KaiOS nee #FirefoxOS was a good and solid basis not just for #LowEnd-Devices but could've been excellent for a more #secure mobile OS, as it has good potential for #sandboxing and #KISS-principle'd #Apps that are lean and efficient.

Noone's gonna build an #App for a platform that is essentially a rounding error from the start!

For purposes of "#secure communication", my #doctor's office has a web site that allows messaging. All I get by email is "hey, you have a message" and then I login and read it. Lots of places do this: banks, medical, government, etc. I sorta get it.

But on the other hand this web-based email interface is nowhere near as useful as, say, gmail or SOGo. I must go to each unread message, click it, click delete, over and over. No 'select all'. No 'mark all as read' or anything. So I see a screen like this, and I think: "welp, there's 70 mouse clicks I'm gonna have to do".

Note that one of them is "automated messages." They're things like appointment reminders. My doctor is pretty aggressive about reminding people about appointments. So they send multiple messages, even if you've already done their "eCheckin" thing. There's just no way to get out of these things.

And I feel like I need to keep this list clean, because if they send me something important, I want to be able to find it. I don't want 35 pointless, out-of-date messages clogging up my #medical patient portal.

Le sigh.

Euro-Stack

#European Industrial Policy bringing together tech, governance & funding for #Europe-focused investment to build & adopt suite of #digital #infrastructures

The vision is to sustain European entrepreneurship and competitiveness (a diverse ecosystem of businesses, SMEs, startups), create resilience, protect our autonomy and sovereignty in a volatile world, and empower the people and businesses of Europe.

euro-stackletter.eu/

Euro-StackEuro-StackThe Letter
#Internet#AI#secure

"we find that participants who had access to an #AI assistant based on #OpenAI's codex-davinci-002 model wrote significantly less secure code than those without access. Additionally, participants with access to an AI assistant were more likely to believe they wrote #secure #code than those without access to the AI assistant. "

arxiv.org/abs/2211.03622

#thereIsNoAI in #security

arXiv.orgDo Users Write More Insecure Code with AI Assistants?We conduct the first large-scale user study examining how users interact with an AI Code assistant to solve a variety of security related tasks across different programming languages. Overall, we find that participants who had access to an AI assistant based on OpenAI's codex-davinci-002 model wrote significantly less secure code than those without access. Additionally, participants with access to an AI assistant were more likely to believe they wrote secure code than those without access to the AI assistant. Furthermore, we find that participants who trusted the AI less and engaged more with the language and format of their prompts (e.g. re-phrasing, adjusting temperature) provided code with fewer security vulnerabilities. Finally, in order to better inform the design of future AI-based Code assistants, we provide an in-depth analysis of participants' language and interaction behavior, as well as release our user interface as an instrument to conduct similar studies in the future.