Eli Grubb · Bookmarks

Saying the obvious thing

Eli Grubb — Sun, 28 Jun 2026 00:00:00 GMT

https://www.seangoedecke.com/saying-the-obvious-thing/

I think the bigger reason it’s hard is for the same reason that it’s hard to draw what you actually see. When I look at a person and try to draw them, I’m not drawing the lines and shades my eye sees… I’m drawing what I know the person looks like, which is a kind of stick-figure approximation. It takes time and effort to drop the layer of interpretation and draw what’s actually there.

So you want to deploy FN-DSA

Eli Grubb — Thu, 14 May 2026 00:00:00 GMT

https://keymaterial.net/2026/05/13/so-you-want-to-deploy-fn-dsa/

For the most part, I agree with my fellow cryptography engineers that the best approach to using FN-DSA is to not. However, prohibition is a failed approach, whether we are talking about drugs or about cryptography, so, in the interest of harm reduction, here are the essential caveats for anyone who wants to use FN-DSA, so that they can do so as safely as possible.

Proxies all the way down

Eli Grubb — Mon, 27 Apr 2026 00:00:00 GMT

https://dadrian.io/blog/posts/exe-github/

I played around with exe.dev this weekend and I’m loving it so far - hopefully I’ll find the brain space to write about my adventures. In the meantime, this post from David Adrian demonstrates why exe.dev is worth paying attention to among the ocean of ai-hyped infra bets: it’s all in the details.

Open source security at Astral

Eli Grubb — Sun, 26 Apr 2026 00:00:00 GMT

https://astral.sh/blog/open-source-security-at-astral

For no particular reason, I got around to finally reviewing this article from the uv maintainers. Excellent advice.

Quantum Computers Are Not a Threat to 128-bit Symmetric Keys

Eli Grubb — Mon, 20 Apr 2026 00:00:00 GMT

https://words.filippo.io/128-bits/

A good reminder.

The Future of Everything is Lies, I Guess

Eli Grubb — Wed, 15 Apr 2026 00:00:00 GMT

https://aphyr.com/posts/411-the-future-of-everything-is-lies-i-guess

Modern ML models are astonishingly capable, and they are also blithering idiots. This should not be even slightly controversial.

Kyle Kingsbury recently released the last section of this excellent essay. One of the better attempts to find a common ground between nuance and truth in this rapidly shifting new world. Too much for one sitting? The pdf and epub options are great!

Some humans are full of LLM-generated material now too—a sort of cognitive microplastics problem.

Thoughts on slowing the fuck down

Eli Grubb — Wed, 25 Mar 2026 00:00:00 GMT

https://mariozechner.at/posts/2026-03-25-thoughts-on-slowing-the-fuck-down/

From Mario Zechner, the creator of the pi coding agent. One of the better actors when it comes to forming nuanced takes on this rapidly changing, grifter friendly world.

A tale about fixing eBPF spinlock issues in the Linux kernel

Eli Grubb — Wed, 18 Mar 2026 00:00:00 GMT

https://rovarma.com/articles/a-tale-about-fixing-ebpf-spinlock-issues-in-the-linux-kernel/

Large-Scale Online Deanonymization with LLMs

Eli Grubb — Mon, 02 Mar 2026 00:00:00 GMT

https://www.schneier.com/blog/archives/2026/03/llm-assisted-deanonymization.html

via Schneier on Security

Did recent events leave you wondering “how could LLMs be useful for spying on citizens”? Here’s just one concrete example.

We show that from a handful of comments, LLMs can infer where you live, what you do, and your interests – then search for you on the web. In our new research, we show that this is not only possible but increasingly practical.

Check out the full paper for details.

Buddy Guy: Tiny Desk Concert

Eli Grubb — Sat, 28 Feb 2026 00:00:00 GMT

https://youtu.be/m5XxOLdMSS8

Buddy Guy brought the house down at Tiny Desk, with a feature from rising-superstar Miles Caton.

Once again, thank you Sinners.

Please, please, please stop using passkeys for encrypting user data

Eli Grubb — Fri, 27 Feb 2026 00:00:00 GMT

https://blog.timcappalli.me/p/passkeys-prf-warning/

When you overload a credential used for authentication by also using it for encryption, the ‘blast radius’ for losing that credential becomes immeasurably larger.

Cryptography Engineering Has An Intrinsic Duty of Care

Eli Grubb — Wed, 25 Feb 2026 00:00:00 GMT

https://soatok.blog/2026/02/25/cryptography-engineering-has-an-intrinsic-duty-of-care/

Zero Knowledge (About) Encryption

Eli Grubb — Tue, 24 Feb 2026 00:00:00 GMT

https://zkae.io/

Password managers are an important area with surprisingly little formal analysis and this work emphasized the importance of fixing that.

To be presented at Real World Crypto 2026 and published at USENIX Security 2026.

Full paper can be found here: https://eprint.iacr.org/2026/058.

Bitwarden’s blog post on the subject is here: https://bitwarden.com/blog/security-through-transparency-eth-zurich-audits-bitwarden-cryptography/¹.

Bad Bunny: Tiny Desk Concert

Eli Grubb — Sun, 08 Feb 2026 00:00:00 GMT

https://youtu.be/ouuPSxE1hK4

A super bowl chaser. The only thing more powerful than hate is love.

Fancy cryptography in the wild🎩

Eli Grubb — Sun, 08 Feb 2026 00:00:00 GMT

https://github.com/fancy-cryptography/fancy-cryptography

via Bas Westerbaan

A curated and crowdsourced list of ~*fancy*~ cryptography protocols, currently deployed at scale.

Some rabbit holes I’m falling down:

WhatsApp Encryption, a Lawsuit, and a Lot of Noise

Eli Grubb — Tue, 03 Feb 2026 00:00:00 GMT

https://blog.cryptographyengineering.com/2026/02/02/whatsapp-encryption-a-lawsuit-and-a-lot-of-noise/

It’s been more than forty years since Ken Thompson delivered his famous talk, “Reflections on Trusting Trust“, which pointed out how there is no avoiding some level of trust. Hence the question here is not: should we trust someone. That decision is already taken. It’s: should we trust that WhatsApp is not running the biggest fraud in technology history.

Look for what's true

Eli Grubb — Sun, 01 Feb 2026 00:00:00 GMT

https://dubroy.com/blog/look-for-whats-true/

Advice as old as time but I often forget. Placed well in the context of today’s workplace.

So, You’ve Hit an Age Gate. What Now?

Eli Grubb — Thu, 22 Jan 2026 00:00:00 GMT

https://www.eff.org/deeplinks/2026/01/so-youve-hit-age-gate-what-now

The EFF also has an age verification resource hub. As usual, it’s full of good resources and advice.

LLMs and your career

Eli Grubb — Tue, 20 Jan 2026 00:00:00 GMT

https://notes.eatonphil.com/2026-01-19-llms-and-your-career.html

The jobs that were dependent on fundamentals of software aren’t going to stop being dependent on fundamentals of software … if you like doing software development, I don’t think interesting software development jobs are going to go away.

The State of OpenSSL for `pyca/cryptography`

Eli Grubb — Wed, 14 Jan 2026 00:00:00 GMT

https://cryptography.io/en/latest/statements/state-of-openssl/

Daniel Caesar: Tiny Desk Concert

Eli Grubb — Thu, 08 Jan 2026 00:00:00 GMT

https://youtu.be/rMWjbb2l5BE

Daniel Caesar returned to Tiny Desk this week 😌

Also worth revisiting his first appearance from 2018: https://youtu.be/PBKa-AAy_vo

University of Utah finds tape with only known copy of UNIX V4 hidden in storage

Eli Grubb — Wed, 07 Jan 2026 00:00:00 GMT

https://www.sltrib.com/news/education/2026/01/07/university-utah-finds-tape-with/

Hidden in storage, a University of Utah research associate happened upon the only known copy of this ‘revolutionary’ software

Stories like this revitalize my love for computing PLUS it’s great seeing the Flux research group highlighted 🫶.

Internet Security Research Group (ISRG) 2025 Annual Report

Eli Grubb — Tue, 06 Jan 2026 00:00:00 GMT

https://www.abetterinternet.org/documents/2025-ISRG-Annual-Report.pdf

A cool reminder that Let’s Encrypt, Divvi Up, and Prossimo are all run by the same org.

What can strong engineers do that weak engineers can't?

Eli Grubb — Tue, 06 Jan 2026 00:00:00 GMT

https://www.seangoedecke.com/weak-engineers/

One way to tell a weak engineer in a discussion thread about some problem is to see who is bringing in specific facts about how the system currently works, and who is making purely general recommendations that could apply to any system. If their messages could all be public tweets, they’re probably not adding much value.

Against Cipher Agility in Cryptography Protocols (2019)

Eli Grubb — Mon, 29 Dec 2025 00:00:00 GMT

https://paragonie.com/blog/2019/10/against-agility-in-cryptography-protocols

Behind the Scenes with iOS Security (2016)

Eli Grubb — Mon, 29 Dec 2025 00:00:00 GMT

https://blackhat.com/docs/us-16/materials/us-16-Krstic.pdf

Ivan Krstić at Black Hat 2016, video available

It's not your codebase

Eli Grubb — Mon, 29 Dec 2025 00:00:00 GMT

https://www.seangoedecke.com/not-your-codebase/

Signatures are like backups (2024)

Eli Grubb — Mon, 29 Dec 2025 00:00:00 GMT

https://alexgaynor.net/2024/sep/09/signatures-are-like-backups/

Key Transparency: Introduction, recent results, and active research areas - Melissa Chase

Eli Grubb — Tue, 23 Dec 2025 00:00:00 GMT

https://youtu.be/GKn0wqwQHCw

The legendary Melissa Chase recently gave a perfect introduction to Key Transparency, including recent results/active areas.

Building a Transparent Keyserver

Eli Grubb — Sat, 20 Dec 2025 00:00:00 GMT

https://words.filippo.io/keyserver-tlog/

Invisible Salamanders Are Not What You Think (2024)

Eli Grubb — Sat, 20 Dec 2025 00:00:00 GMT

https://soatok.blog/2024/09/10/invisible-salamanders-are-not-what-you-think/

Picking parameters (2022)

Eli Grubb — Sat, 20 Dec 2025 00:00:00 GMT

https://www.imperialviolet.org/2022/03/15/pickingparameters.html

Experimenting with Post-Quantum Cryptography

Eli Grubb — Wed, 19 Nov 2025 00:00:00 GMT

https://www.wolfssl.com/documentation/manuals/wolfssl/appendix07.html

Your job is to deliver code you have proven to work

Eli Grubb — Tue, 18 Nov 2025 00:00:00 GMT

https://simonwillison.net/2025/Dec/18/code-proven-to-work/

We need to deliver code that works—and we need to include proof that it works as well. Not doing that directly shifts the burden of the actual work to whoever is expected to review our code.

What Every Programmer Should Know about How CPUs Work • Matt Godbolt

Eli Grubb — Wed, 12 Nov 2025 00:00:00 GMT

https://youtu.be/-HNpim5x-IE

The Typestate Pattern in Rust

Eli Grubb — Fri, 07 Nov 2025 00:00:00 GMT

https://cliffle.com/blog/rust-typestate/

Cryptography-specific chaser: Implementing As-Safe-As-Possible, Misuse-Resistant Cryptographic Libraries: Part I.

clipping.: Tiny Desk Concert

Eli Grubb — Wed, 05 Nov 2025 00:00:00 GMT

https://youtu.be/h0-k7vW9Xek

Arenas in Rust (2021)

Eli Grubb — Thu, 16 Oct 2025 00:00:00 GMT

https://manishearth.github.io/blog/2021/03/15/arenas-in-rust/

Too Much Crypto (2019)

Eli Grubb — Sun, 05 Oct 2025 00:00:00 GMT

https://eprint.iacr.org/2019/1492.pdf

JP Aumasson on Too Much Crypto in 2025:

Too Much Crypto hasnt aged … [as expected, just diminishing returns from incremental high-complexity/memory cryptanalysis.]

Should I Switch From Git to Jujutsu?

Eli Grubb — Thu, 02 Oct 2025 00:00:00 GMT

https://etodd.io/2025/10/02/should-i-switch-from-git-to-jujutsu/

The UK Is Still Trying to Backdoor Encryption for Apple Users

Eli Grubb — Wed, 01 Oct 2025 00:00:00 GMT

https://www.eff.org/deeplinks/2025/10/uk-still-trying-backdoor-encryption-apple-users

A Tour of WebAuthn (2024)

Eli Grubb — Wed, 24 Sep 2025 00:00:00 GMT

https://www.imperialviolet.org/tourofwebauthn/tourofwebauthn.html

Shooting Moving Masters Zemeckis Style (2021)

Eli Grubb — Mon, 22 Sep 2025 00:00:00 GMT

https://youtu.be/lhyV097_Q-g

Don't write bugs

Eli Grubb — Fri, 19 Sep 2025 00:00:00 GMT

https://www.teamten.com/lawrence/programming/dont-write-bugs.html

`TIGER_STYLE`

Eli Grubb — Wed, 17 Sep 2025 00:00:00 GMT

https://github.com/tigerbeetle/tigerbeetle/blob/main/docs/TIGER_STYLE.md

Add asserts everywhere.

Also see matklad’s What is an Invariant?.

Burroughs' B6500/B7500 stack mechanism (1968)

Eli Grubb — Tue, 16 Sep 2025 00:00:00 GMT

https://people.eecs.berkeley.edu/~culler/courses/cs252-s05/papers/burroughs.pdf

Lord of the `io_uring`

Eli Grubb — Wed, 10 Sep 2025 00:00:00 GMT

https://unixism.net/loti/index.html

`Scrypt` is Maximally Memory-Hard (2016)

Eli Grubb — Wed, 10 Sep 2025 00:00:00 GMT

https://eprint.iacr.org/2016/989.pdf

Inside Zig's New Writer

Eli Grubb — Wed, 03 Sep 2025 00:00:00 GMT

https://joegm.github.io/blog/inside-zigs-new-writer-interface/

"Clean" Code, Horrible Performance (2023)

Eli Grubb — Tue, 26 Aug 2025 00:00:00 GMT

https://youtu.be/tD5NrevFtbU

Zig 0.15.1 Release Notes

Eli Grubb — Wed, 20 Aug 2025 00:00:00 GMT

https://ziglang.org/download/0.15.1/release-notes.html

Shredding Your Garbage: Reducing Data Lifetime Through Secure Deallocation (2005)

Eli Grubb — Mon, 18 Aug 2025 00:00:00 GMT

https://www.usenix.org/legacy/publications/library/proceedings/sec05/tech/full_papers/chow/chow.pdf

From USENIX Security 2005!

without [secure deallocation], data can remain in memory for days or weeks, even persisting across reboots.

The span from first write to last read is the ideal lifetime. The data must exist in the system at least this long. The span from first write to deallocation is the secure deallocation lifetime. The span from first write to the first write of the next allocation is the natural lifetime. Because programs often rely on reallocation and overwrite to eliminate sensitive data, the natural lifetime is the expected data lifetime in systems without secure deallocation.

Jujutsu For Busy Devs

Eli Grubb — Mon, 04 Aug 2025 00:00:00 GMT

https://maddie.wtf/posts/2025-07-21-jujutsu-for-busy-devs

Zero Knowledge Proofs Alone Are Not a Digital ID Solution to Protecting User Privacy

Eli Grubb — Wed, 30 Jul 2025 00:00:00 GMT

https://www.eff.org/deeplinks/2025/07/zero-knowledge-proofs-alone-are-not-digital-id-solution-protecting-user-privacy

High-assurance zeroization (2023)

Eli Grubb — Tue, 29 Jul 2025 00:00:00 GMT

https://eprint.iacr.org/2023/1713.pdf

Eli Grubb · Bookmarks

Saying the obvious thing

So you want to deploy FN-DSA

Proxies all the way down

Open source security at Astral

Quantum Computers Are Not a Threat to 128-bit Symmetric Keys

The Future of Everything is Lies, I Guess

Thoughts on slowing the fuck down

A tale about fixing eBPF spinlock issues in the Linux kernel

Large-Scale Online Deanonymization with LLMs

Buddy Guy: Tiny Desk Concert

Please, please, please stop using passkeys for encrypting user data

Cryptography Engineering Has An Intrinsic Duty of Care

Zero Knowledge (About) Encryption

Bad Bunny: Tiny Desk Concert

Fancy cryptography in the wild🎩

WhatsApp Encryption, a Lawsuit, and a Lot of Noise

Look for what's true

So, You’ve Hit an Age Gate. What Now?

LLMs and your career

The State of OpenSSL for pyca/cryptography

Daniel Caesar: Tiny Desk Concert

University of Utah finds tape with only known copy of UNIX V4 hidden in storage

Internet Security Research Group (ISRG) 2025 Annual Report

What can strong engineers do that weak engineers can't?

Against Cipher Agility in Cryptography Protocols (2019)

Behind the Scenes with iOS Security (2016)

It's not your codebase

Signatures are like backups (2024)

Key Transparency: Introduction, recent results, and active research areas - Melissa Chase

Building a Transparent Keyserver

Invisible Salamanders Are Not What You Think (2024)

Picking parameters (2022)

Experimenting with Post-Quantum Cryptography

Your job is to deliver code you have proven to work

What Every Programmer Should Know about How CPUs Work • Matt Godbolt

The Typestate Pattern in Rust

clipping.: Tiny Desk Concert

Arenas in Rust (2021)

Too Much Crypto (2019)

Should I Switch From Git to Jujutsu?

The UK Is Still Trying to Backdoor Encryption for Apple Users

A Tour of WebAuthn (2024)

Shooting Moving Masters Zemeckis Style (2021)

Don't write bugs

TIGER_STYLE

Burroughs' B6500/B7500 stack mechanism (1968)

Lord of the io_uring

Scrypt is Maximally Memory-Hard (2016)

Inside Zig's New Writer

"Clean" Code, Horrible Performance (2023)

Zig 0.15.1 Release Notes

Shredding Your Garbage: Reducing Data Lifetime Through Secure Deallocation (2005)

Jujutsu For Busy Devs

Zero Knowledge Proofs Alone Are Not a Digital ID Solution to Protecting User Privacy

High-assurance zeroization (2023)

The State of OpenSSL for `pyca/cryptography`

`TIGER_STYLE`

Lord of the `io_uring`

`Scrypt` is Maximally Memory-Hard (2016)