Filippo Valsorda
Person on 4 sites
Filippo Valsorda is a cryptography engineer and professional open-source maintainer.
-
6 facts on wiqqi (opens wiqqi.app)
- Maintains: The cryptography standard library of the Go programming language (opens wiqqi.app)
- Before: Lead of the Go Security team at Google, until 2022; Cryptography team at Cloudflare, until 2017 (opens wiqqi.app)
- Founded: Geomys (opens wiqqi.app)
-
3 channels on ppll (opens ppll.app)
-
Bluesky: @filippo.abyssdomain.expert (opens bsky.app)
“Kinda sad about the OpenSSH choice of post-quantum auth algorithm, Ed25519 + ML-DSA-44. I would have gone with pure ML-DSA-44, but hybrid had one advantage: hardware support. Unfortunately, they chose Ed25519 which…”
-
GitHub: @FiloSottile (opens github.com)
“bsky-backup — @filippo.abyssdomain.expert”
-
Blog: filippo.io (opens filippo.io)
“The NIST Elliptic Curves Seeds Bounty Has Been Claimed”
-
Bluesky: @filippo.abyssdomain.expert (opens bsky.app)
-
12 beliefs on korrents (opens korrents.com)
-
Companies are willing to pay for their critical open source dependencies; what is missing is a legible way for projects to sell it to them. (opens korrents.com)
“I started with a rather non-consensus hypothesis: companies want to pay for their critical open source dependencies, but most projects are not selling them a legible way to do so.”
-
The thing open source can actually sell is not the code but access to its maintainers’ attention and expertise. (opens korrents.com)
“Clients still pay a fixed monthly retainer to ensure the professional maintenance of the whole portfolio, and to get access to the expertise of all of Geomys’ maintainers.”
-
Open source maintenance can be a mature profession organised into small specialist firms, the way law and medicine already are. (opens korrents.com)
“From the onset, I envisioned small firms of professional maintainers with thematic portfolios, accommodating diverse maintainers and project sizes, just like the specialized firms of other professionals.”
-
Companies are willing to pay for their critical open source dependencies; what is missing is a legible way for projects to sell it to them. (opens korrents.com)
-
7 recommendations on rcmnd (opens rcmnd.app)
-
govulncheck (opens rcmnd.app)
“I recommend turning it off and replacing it with a pair of scheduled GitHub Actions, one running govulncheck, and the other running your test suite against the latest version of your dependencies.”
-
Claude Code (opens rcmnd.app)
“Three out of three one-shot debugging hits with no help is extremely impressive.”
-
YubiKey (opens rcmnd.app)
“Secrets are encrypted to two keys generated on two YubiKeys with the default settings of age-plugin-yubikey. These keys can’t be extracted or cracked by any attacker, regardless of how compromised my laptop or vault…”
-
govulncheck (opens rcmnd.app)