- bsky-backup — @filippo.abyssdomain.expert
- scrape-cmvp-mip — https://csrc.nist.gov/Projects/cryptographic-module-validation-program/modules-in-process/modules-in-process-list
- intermediates — Package filippo.io/intermediates embeds a bundle of known unexpired, unrevoked intermediate certificates chaining to roots in the Mozilla Root Program
Filippo Valsorda
Cryptography engineer; maintains Go's cryptography libraries as a full-time open-source maintainer, funded directly by companies that use them.
Filippo Valsorda did not write this page. ppll compiled it from their own words, each linked to the source. Is this you? · Report a mistake
Latest GitHub
What they believe
-
Companies are willing to pay for their critical open source dependencies; what is missing is a legible way for projects to sell it to them.
I started with a rather non-consensus hypothesis: companies want to pay for their critical open source dependencies, but most projects are not selling them a legible way to do so.
words.filippo.ioSaid 8 Jul 2024This on korrents
-
Maintainers of widely used open source software are not adequately funded, and that is a real and unsolved problem.
This experiment started from the observation that despite being critical for the functioning of the Internet—and, by extension, the economy—the role of open-source maintainer has not yet found a sustainable manifestation.
words.filippo.ioSaid 2 Feb 2023This on korrents
The bold line is korrents’ wording; the quote is theirs. These 2: what they wrote before what they said aloud, one per source, newest first.
Feed
As its own page →Hiding
4 November
3 November
2 November
28 October
26 October
24 October
- Bluesky
- GitHubtorchwood — A collection of open source tlog tooling.
- Bluesky
22 October
21 October
20 October
17 October
16 October
15 October
14 October
12 October
24 September
30 August
29 August
28 August
26 July
20 July
14 July
23 June
20 April
6 April
20 February
-
Recommendsrcmnd.app
govulncheckTheir words
I recommend turning it off and replacing it with a pair of scheduled GitHub Actions, one running govulncheck, and the other running your test suite against the latest version of your dependencies.
12 February
5 January
Nothing matches.
Beliefs
Korrents What they believe 12 beliefs — each backed by an exact quote.
Each is a — compiled by korrents.com, not by them: the one-line wordings are korrents', the quotes are theirs.
Recent
Companies are willing to pay for their critical open source dependencies; what is missing is a legible way for projects to sell it to them.
I started with a rather non-consensus hypothesis: companies want to pay for their critical open source dependencies, but most projects are not selling them a legible way to do so.
Geomys, a blueprint for a sustainable open source maintenance firm Said 8 Jul 2024
The thing open source can actually sell is not the code but access to its maintainers’ attention and expertise.
Clients still pay a fixed monthly retainer to ensure the professional maintenance of the whole portfolio, and to get access to the expertise of all of Geomys’ maintainers.
Geomys, a blueprint for a sustainable open source maintenance firm Said 8 Jul 2024
Open source maintenance can be a mature profession organised into small specialist firms, the way law and medicine already are.
From the onset, I envisioned small firms of professional maintainers with thematic portfolios, accommodating diverse maintainers and project sizes, just like the specialized firms of other professionals.
Geomys, a blueprint for a sustainable open source maintenance firm Said 8 Jul 2024
Show 9 more
Maintainers of widely used open source software are not adequately funded, and that is a real and unsolved problem.
This experiment started from the observation that despite being critical for the functioning of the Internet—and, by extension, the economy—the role of open-source maintainer has not yet found a sustainable manifestation.
I’m Now a Full-Time Professional Open Source Maintainer Said 2 Feb 2023
Volunteering cannot sustain critical software, because a volunteer’s life circumstances change and the project’s need does not.
Volunteerism is self-evidently not sustainable, as people’s life circumstances change.
I’m Now a Full-Time Professional Open Source Maintainer Said 2 Feb 2023
Foundations, on the whole, do not pay the maintainers of the projects they exist to support.
Virtually all maintainers are either volunteers or full-time employees of large companies. Foundations on average don’t pay maintainers.
I’m Now a Full-Time Professional Open Source Maintainer Said 2 Feb 2023
Employing a maintainer inside a large company breaks down exactly when the project succeeds: the workload grows while its value to the employer stays flat.
As a project gets more popular in the ecosystem, the workload increases but the value of that project for the company stays the same, so resources don’t increase accordingly.
I’m Now a Full-Time Professional Open Source Maintainer Said 2 Feb 2023
A dependency you would need engineer-months to replace or fork is a critical one, and retaining its maintainer is straightforward business sense.
This is how I frame it: if the effort required to replace or fork a dependency should it go unmaintained is measured in engineer-months, that’s a critical dependency and retaining its maintainers probably makes good business sense.
I’m Now a Full-Time Professional Open Source Maintainer Said 2 Feb 2023
A contribution is a cost to the maintainer, not a gift: it is taking part, not merely using the code, that consumes a project’s scarcest resource.
I often read advice along the lines of “if you want to help a project send PRs” and I never understood it. Reviewing and iterating or pushing back on PRs is work! Often more than writing the code itself.
How to pay professional maintainers Said 17 Mar 2022
Funding should pay for maintenance, not features, because every new feature adds to the burden the money was meant to relieve.
Finally, the health of the project depends on issue triage, bug fixes, refactors, and design work more than on new features. In fact, new features increase the maintenance burden.
How to pay professional maintainers Said 17 Mar 2022
Paying a maintainer must not buy a say in the project’s direction; funding and governance have to be kept as separate as possible.
Governance is a delicate and complex topic, and you want to leave it as orthogonal as possible to funding.
How to pay professional maintainers Said 17 Mar 2022
A token monthly donation shows appreciation and achieves nothing else; sustaining a maintainer takes a real fraction of an engineering salary.
$1,000/month without benefits is a nice way to show appreciation, but won’t achieve any other goals.
How to pay professional maintainers Said 17 Mar 2022
Beliefs others hold too
Maintainers of widely used open source software are not adequately funded, and that is a real and unsolved problem. 3 hold this
This experiment started from the observation that despite being critical for the functioning of the Internet—and, by extension, the economy—the role of open-source maintainer has not yet found a sustainable manifestation.
I’m Now a Full-Time Professional Open Source Maintainer Said 2 Feb 2023
The thing open source can actually sell is not the code but access to its maintainers’ attention and expertise. 2 hold this
Clients still pay a fixed monthly retainer to ensure the professional maintenance of the whole portfolio, and to get access to the expertise of all of Geomys’ maintainers.
Geomys, a blueprint for a sustainable open source maintenance firm Said 8 Jul 2024
A contribution is a cost to the maintainer, not a gift: it is taking part, not merely using the code, that consumes a project’s scarcest resource. 2 hold this
I often read advice along the lines of “if you want to help a project send PRs” and I never understood it. Reviewing and iterating or pushing back on PRs is work! Often more than writing the code itself.
How to pay professional maintainers Said 17 Mar 2022
What is a korrent?
A korrent is a belief a person has stated in their own words: one sentence stating the claim, backed by a quote and a source, kept at korrents.com.
Under a name here, the quoted block is what they actually said. The korrent beneath it is the claim those words support, in korrents' wording — tap it to see the record, its source, and who else holds it.
Nobody here wrote their own korrents. They are compiled from public statements, and a person can change their mind, which is recorded too.
Recommends rcmnd
rcmnd What they recommend 7 things — each backed by an exact quote.
Compiled by rcmnd.app, not by them: the quotes are theirs, and each links to the post it was copied from.
Recent
Recommends govulncheck
I recommend turning it off and replacing it with a pair of scheduled GitHub Actions, one running govulncheck, and the other running your test suite against the latest version of your dependencies.
words.filippo.io 20 Feb 2026
Loved Claude Code
Three out of three one-shot debugging hits with no help is extremely impressive.
words.filippo.io 1 Nov 2025
sponsored
Uses iTerm2
I have it on $PATH as p, and ⌘-0 brings up iTerm2, so I can do
words.filippo.io 28 Dec 2022
Show 4 more
Liked fzf
A big usability upgrade is a five-lines bash script that uses fzf to provide fuzzy search.
words.filippo.io 28 Dec 2022
Uses restic
Each secret is stored in a separate file in $PASSAGE_DIR, which I keep synced with Syncthing and backed up with restic.
words.filippo.io 28 Dec 2022
Uses Syncthing
Each secret is stored in a separate file in $PASSAGE_DIR, which I keep synced with Syncthing and backed up with restic.
words.filippo.io 28 Dec 2022
Uses YubiKey
Secrets are encrypted to two keys generated on two YubiKeys with the default settings of age-plugin-yubikey. These keys can’t be extracted or cracked by any attacker, regardless of how compromised my laptop or vault gets.
words.filippo.io 28 Dec 2022
Where they publish
Blog filippo.io His blog on cryptography, Go and funding maintenance. Has a feed.
Recent
- The NIST Elliptic Curves Seeds Bounty Has Been Claimed 16 Oct 2026 We now know how the seeds of the NIST elliptic curves were generated: they’re not the hash of some saucy sentence, but the output of drand48() seeded with the time, which was indeed in 1997–98.
- (Post-Quantum) Cryptographic Right Answers 12 Oct 2026 In the tradition started by Colin Percival and Thomas Ptacek, a set of “Cryptographic Right Answers” updated for the accelerated post-quantum transition timeline.
- Production ML-DSA Verification in 350 Lines of Python 26 Jul 2026 I am publishing a production, pure-Python ML-DSA verifier. It's just 350 lines, and pretty readable and robust.
Show 7 more
- Opaque, Interoperable Passkey Records (and a Go API) 20 Jul 2026 Passkey records are an interoperable format for WebAuthn credentials, similar to password hash strings. I propose a potential crypto/passkey Go API based on them.
- Vulnerability Reports Are Not Special Anymore 23 Jun 2026 We needed the insight and confidentiality to protect our users, but now that anyone can get the same results from LLM?
- Quantum Computers Are Not a Threat to 128-bit Symmetric Keys 20 Apr 2026 There is no need to update symmetric key sizes as part of the post-quantum transition, due to the details of how Grover's algorithm scales. Most authorities agree.
- A Cryptography Engineer’s Perspective on Quantum Computing Timelines 6 Apr 2026 The risk that cryptographically-relevant quantum computers materialize within the next few years is now high enough to be dispositive, unfortunately.
- Turn Dependabot Off 20 Feb 2026 I recommend turning Dependabot off and replacing it with a pair of scheduled GitHub Actions, one running govulncheck, and the other running CI against the latest version of your dependencies.
- Inspecting the Source of Go Modules 12 Feb 2026 Code hosts like GitHub don't necessarily show the correct source of Go modules. pkg.geomys.dev is a new convenient viewer for module source.
- go.sum Is Not a Lockfile 5 Jan 2026 In Go, go.mod acts as both manifest and lockfile. There is never a reason to look at go.sum.
Link verified 20 Sept 2026. Recent items update automatically from the channel.
Bluesky @filippo.abyssdomain.expert Their Bluesky account.
Recent
- Kinda sad about the OpenSSH choice of post-quantum auth algorithm, Ed25519 + ML-DSA-44. I would have gone with pure ML-DSA-44, but hybrid had one advantage: hardware support. Unfortunately, they chose Ed25519 which won't work with TPMs, SEs, and pre-2024 PIV YubiKeys. 2 Nov 2026
- Well that's a first for me: an NTP Pool server sent a wildly wrong time, and systemd-timesyncd jumped the system time on Trastevere first forward 0.82s and then *backwards* 0.76s. Thankfully Sunlight failed safe, crashed (which fired alerts), and recovered once the clock caught up. WTF? 24 Oct 2026
- New superpower: a folder with the versioned md/txt of all the specs relevant to your implementation, plus an agent with a "read @specs/" instruction. 24 Oct 2026
Show 17 more
- This ty + uv integration for PEP 723 might definitively make Python my go-to language for scripts. No more bash at any size. 24 Oct 2026 astral.sh
- The LLM model I arguably use the most, the one doing autocompletion in VS Code, seems to have gotten a lot worse. Like, giving the wrong field name for a struct defined 200 lines above. Is there a way to plug in a better model? VS Code claims it can only be GPT-4.1 (!) Codex. 22 Oct 2026
- The macOS built-in curl, git, pip, python3, perl, ruby, and openssl all read /etc/ssl/cert.pem, which still has the emSign root, but they don't check revocation like Apple's Secure Transport libraries. This is, uh, a problem. git and pip especially. I added a short-term workaround to this page. 21 Oct 2026
- After the firefighting is done (and a nap) we'll need to have a long, serious conversation about the state of non-browser non-platform X.509 verifiers. The Linux status quo is "a pile of PEM files behind a dumpster" and that's not an acceptable excuse for a root store in 2026. 20 Oct 2026
- 🚨 Six WebPKI Intermediate CAs are compromised. This is bigger than Heartbleed, but a client-side issue. Anything that verifies certificates against public roots, like most TLS clients, is/was affected. Details, live test, patched versions and workarounds at emudhra.we-have-a-problem.com Act now. 20 Oct 2026
- THIS IS NOT A DRILL. If you package/distribute/maintain root stores or chain verifiers, act immediately. If you know how to remove trust in a root, consider doing it now. Otherwise, prepare to update systems as patches/mitigations come. Go users, update to Go 1.27.3 or Go 1.26.10. 20 Oct 2026
- Update everything that verifies certificates against public roots. 20 Oct 2026
- After 10 years, I disabled my lobste.rs account. I think it's clear I am not a culture fit anymore with whatever it is they have going on there. I feel more and more like I don't belong in almost any tech community because I believe LLM agents are real, passkeys are good, and fascism is bad. 17 Oct 2026
- Anthropic found the origin of the NIST elliptic curve seeds: they were generated with drand48()! No one was seriously worried, but this should put some FUD to rest, completing the NIST ECC rehabilitation arc… just in time to be retired in favor of PQ. Also, we raised $36 Ki for ISRG. Yay! 16 Oct 2026
- No more leap seconds, ever! There isn’t one in December and they will be abolished in May. The last one will forever be the 2016(?!) one. Didn’t realize having experienced leap seconds in prod dates me. I’m not going to miss time going backwards, I’ll be honest. 15 Oct 2026 bipm.org
- Cobblestone-128 chunked (aka streaming) encryption in TypeScript for Node.js 22+, Bun, Deno, and all recent browsers. One-shot, transform stream, and random access decryption APIs. Uses the Web Crypto API for AES-GCM, with fallback on the noble cryptography libraries. 14 Oct 2026
- Publishing “Cryptographic Right Answers” for developers is a tradition by now. Colin Percival started in 2009, Thomas Ptacek followed up in 2015, and then Latacora carried on in 2018 and 2024. I put together a list updated for the renewed urgency of migrating to post-quantum algorithms. 12 Oct 2026
- 🏍️🦋 28 Sept 2026
- I'm excited to announce that the PLC Organization now has a statute! And a bank account! And a @standard.site publication! All the important stuff. The PLC Org is an independent Swiss Association meant to operate the PLC directory, which collects and distributes signed updates to atproto accounts. 28 Sept 2026
- The thing that worries me most lately is that many people who know that “fascism is bad, actually” have also convinced themselves that AI tools must be eschewed as fake or impure. In a self-reinforcing loop, there is relatively little AI tooling and infra by “fascism is bad” folks. 28 Sept 2026
- filippo.io/mldsa@v1.0.0 is now updated to the Go 1.27 implementation and API. It's also now a transparent wrapper on Go 1.27+ using type aliases, so the same program can use it alongside crypto/mldsa without issues. Essentially, it's a drop-in compatibility replacement for crypto/mldsa. 24 Sept 2026
- We got paged the other night, so now I know a lot more about ZFS internals than I ever thought I would. 17 Sept 2026 groups.google.com
Link verified 23 Sept 2026. Recent items update automatically from the channel.
GitHub @FiloSottile Their code.
Recent
- bsky-backup — @filippo.abyssdomain.expert 4 Nov 2026
- scrape-cmvp-mip — https://csrc.nist.gov/Projects/cryptographic-module-validation-program/modules-in-process/modules-in-process-list 4 Nov 2026
- intermediates — Package filippo.io/intermediates embeds a bundle of known unexpired, unrevoked intermediate certificates chaining to roots in the Mozilla Root Program 4 Nov 2026
Show 14 more
- mostly-harmless — A bag of various unrelated projects with varying levels of serviceability and destructiveness. 3 Nov 2026
- sunlight — A Certificate Transparency log implementation and monitoring API designed for scalability, ease of operation, and reduced cost. 28 Oct 2026
- passkey 26 Oct 2026
- torchwood — A collection of open source tlog tooling. 24 Oct 2026
- cobblestone.ts — A TypeScript implementation of Cobblestone-128 chunked encryption, available as an npm package or as a bundled .js file. 14 Oct 2026
- mldsa 24 Sept 2026
- mlockexe — Package mlockexe locks the running executable's file-backed pages in memory, so they can't be evicted under memory pressure. 30 Aug 2026
- age — A simple, modern and secure encryption tool (and Go library) with small explicit keys, no config options, and UNIX-style composability. 29 Aug 2026
- cobblestone — Package cobblestone implements the chunked (or streaming) encryption scheme Cobblestone-128, as described in c2sp.org/chunked-encryption. 29 Aug 2026
- typage — A TypeScript implementation of the age file encryption format, available as an npm package or as a bundled .js file. 28 Aug 2026
- mldsa-py — Pure-Python ML-DSA (FIPS 204) signature verification. Python 3.8+, zero dependencies, public domain, single file, 350 lines. 26 Jul 2026
- xaes256gcm — Package xaes256gcm implements the XAES-256-GCM extended-nonce AEAD. 14 Jul 2026
- keygen — Deterministic key generation for Go. 25 Jun 2026
- awesome-age — A collection of projects and resources in the age file encryption ecosystem. 21 Jun 2026
Link verified 23 Sept 2026. Recent items update automatically from the channel.
About the English under a post
Some people here publish in a language other than English. Where they do, this site shows a machine translation beneath the post, in this typeface — the site's own, not theirs.
The post itself is never changed, moved or hidden: what is set in the serif above is exactly what the person published, and it is what to quote them on. A translation can be wrong in ways that matter, especially about tone.
Only the post's own words are translated. A quoted post, a linked article and a belief on korrents.com are left in their original language.