Filippo Valsorda
Cryptography engineer; maintains Go's cryptography libraries as a full-time open-source maintainer, funded directly by companies that use them.
Filippo Valsorda did not write this page. What is this?
It collects the places they publish and what they have said there, each linked to the source. They have no account here. Is this you? Claim it, correct it, or ask us to remove it from ppll.
Where they publish
Blog filippo.io His blog on cryptography, Go and funding maintenance. Has a feed.
Recent
- Production ML-DSA Verification in 350 Lines of Python 26 Jul 2026 I am publishing a production, pure-Python ML-DSA verifier. It's just 350 lines, and pretty readable and robust.
- Opaque, Interoperable Passkey Records (and a Go API) 20 Jul 2026 Passkey records are an interoperable format for WebAuthn credentials, similar to password hash strings. I propose a potential crypto/passkey Go API based on them.
- Vulnerability Reports Are Not Special Anymore 23 Jun 2026 We needed the insight and confidentiality to protect our users, but now that anyone can get the same results from LLM?
Show 7 more
- Quantum Computers Are Not a Threat to 128-bit Symmetric Keys 20 Apr 2026 There is no need to update symmetric key sizes as part of the post-quantum transition, due to the details of how Grover's algorithm scales. Most authorities agree.
- A Cryptography Engineer’s Perspective on Quantum Computing Timelines 6 Apr 2026 The risk that cryptographically-relevant quantum computers materialize within the next few years is now high enough to be dispositive, unfortunately.
- Turn Dependabot Off 20 Feb 2026 I recommend turning Dependabot off and replacing it with a pair of scheduled GitHub Actions, one running govulncheck, and the other running CI against the latest version of your dependencies.
- Inspecting the Source of Go Modules 12 Feb 2026 Code hosts like GitHub don't necessarily show the correct source of Go modules. pkg.geomys.dev is a new convenient viewer for module source.
- go.sum Is Not a Lockfile 5 Jan 2026 In Go, go.mod acts as both manifest and lockfile. There is never a reason to look at go.sum.
- Building a Transparent Keyserver 19 Dec 2025 We apply a transparency log to a centralized keyserver step-by-step, in less than 500 lines, with privacy protections, anti-poisoning, and witness cosigning.
- The 2025 Go Cryptography State of the Union 20 Nov 2025 I delivered my traditional Go Cryptography State of the Union talk at GopherCon US 2025 in New York. It goes into everything that happened at the intersection of Go and cryptography over the last year.
Link verified 20 Sept 2026. Recent items update automatically from the channel.
Beliefs
Korrents What they believe 12 beliefs — each backed by an exact quote.
Each is a — compiled by korrents.com, not by them: the one-line wordings are korrents', the quotes are theirs.
Recent
Companies are willing to pay for their critical open source dependencies; what is missing is a legible way for projects to sell it to them.
I started with a rather non-consensus hypothesis: companies want to pay for their critical open source dependencies, but most projects are not selling them a legible way to do so.
Geomys, a blueprint for a sustainable open source maintenance firm Said 8 Jul 2024
The thing open source can actually sell is not the code but access to its maintainers’ attention and expertise.
Clients still pay a fixed monthly retainer to ensure the professional maintenance of the whole portfolio, and to get access to the expertise of all of Geomys’ maintainers.
Geomys, a blueprint for a sustainable open source maintenance firm Said 8 Jul 2024
Open source maintenance can be a mature profession organised into small specialist firms, the way law and medicine already are.
From the onset, I envisioned small firms of professional maintainers with thematic portfolios, accommodating diverse maintainers and project sizes, just like the specialized firms of other professionals.
Geomys, a blueprint for a sustainable open source maintenance firm Said 8 Jul 2024
Show 9 more
Maintainers of widely used open source software are not adequately funded, and that is a real and unsolved problem.
This experiment started from the observation that despite being critical for the functioning of the Internet—and, by extension, the economy—the role of open-source maintainer has not yet found a sustainable manifestation.
I’m Now a Full-Time Professional Open Source Maintainer Said 2 Feb 2023
Volunteering cannot sustain critical software, because a volunteer’s life circumstances change and the project’s need does not.
Volunteerism is self-evidently not sustainable, as people’s life circumstances change.
I’m Now a Full-Time Professional Open Source Maintainer Said 2 Feb 2023
Foundations, on the whole, do not pay the maintainers of the projects they exist to support.
Virtually all maintainers are either volunteers or full-time employees of large companies. Foundations on average don’t pay maintainers.
I’m Now a Full-Time Professional Open Source Maintainer Said 2 Feb 2023
Employing a maintainer inside a large company breaks down exactly when the project succeeds: the workload grows while its value to the employer stays flat.
As a project gets more popular in the ecosystem, the workload increases but the value of that project for the company stays the same, so resources don’t increase accordingly.
I’m Now a Full-Time Professional Open Source Maintainer Said 2 Feb 2023
A dependency you would need engineer-months to replace or fork is a critical one, and retaining its maintainer is straightforward business sense.
This is how I frame it: if the effort required to replace or fork a dependency should it go unmaintained is measured in engineer-months, that’s a critical dependency and retaining its maintainers probably makes good business sense.
I’m Now a Full-Time Professional Open Source Maintainer Said 2 Feb 2023
A contribution is a cost to the maintainer, not a gift: it is taking part, not merely using the code, that consumes a project’s scarcest resource.
I often read advice along the lines of “if you want to help a project send PRs” and I never understood it. Reviewing and iterating or pushing back on PRs is work! Often more than writing the code itself.
How to pay professional maintainers Said 17 Mar 2022
Funding should pay for maintenance, not features, because every new feature adds to the burden the money was meant to relieve.
Finally, the health of the project depends on issue triage, bug fixes, refactors, and design work more than on new features. In fact, new features increase the maintenance burden.
How to pay professional maintainers Said 17 Mar 2022
Paying a maintainer must not buy a say in the project’s direction; funding and governance have to be kept as separate as possible.
Governance is a delicate and complex topic, and you want to leave it as orthogonal as possible to funding.
How to pay professional maintainers Said 17 Mar 2022
A token monthly donation shows appreciation and achieves nothing else; sustaining a maintainer takes a real fraction of an engineering salary.
$1,000/month without benefits is a nice way to show appreciation, but won’t achieve any other goals.
How to pay professional maintainers Said 17 Mar 2022
Beliefs others hold too
Maintainers of widely used open source software are not adequately funded, and that is a real and unsolved problem. 3 hold this
This experiment started from the observation that despite being critical for the functioning of the Internet—and, by extension, the economy—the role of open-source maintainer has not yet found a sustainable manifestation.
I’m Now a Full-Time Professional Open Source Maintainer Said 2 Feb 2023
The thing open source can actually sell is not the code but access to its maintainers’ attention and expertise. 2 hold this
Clients still pay a fixed monthly retainer to ensure the professional maintenance of the whole portfolio, and to get access to the expertise of all of Geomys’ maintainers.
Geomys, a blueprint for a sustainable open source maintenance firm Said 8 Jul 2024
A contribution is a cost to the maintainer, not a gift: it is taking part, not merely using the code, that consumes a project’s scarcest resource. 2 hold this
I often read advice along the lines of “if you want to help a project send PRs” and I never understood it. Reviewing and iterating or pushing back on PRs is work! Often more than writing the code itself.
How to pay professional maintainers Said 17 Mar 2022
What is a korrent?
A korrent is a belief a person has stated in their own words: one sentence stating the claim, backed by a quote and a source, kept at korrents.com.
Under a name here, the quoted block is what they actually said. The korrent beneath it is the claim those words support, in korrents' wording — tap it to see the record, its source, and who else holds it.
Nobody here wrote their own korrents. They are compiled from public statements, and a person can change their mind, which is recorded too.
About the English under a post
Some people here publish in a language other than English. Where they do, this site shows a machine translation beneath the post, in this typeface — the site's own, not theirs.
The post itself is never changed, moved or hidden: what is set in the serif above is exactly what the person published, and it is what to quote them on. A translation can be wrong in ways that matter, especially about tone.
Only the post's own words are translated. A quoted post, a linked article and a belief on korrents.com are left in their original language.