How much do you know about cryptography?

I’ve written tons about why this approach was taken, but it might be inaccessible to someone with limited knowledge of modern cryptography protocol design. (Authenticated encryption, forward secrecy, context commitment, etc.)

This was my earliest blog post on the topic, if you want a place to start.

Your instance admin subtitutes the public key in your profile with one they control.

How do you stop this?

Like, half the point of E2EE for DMs is to prevent instance admins from seeing what your messages say. The other half is to prevent instance admins from being able to surrender anything useful to government subpoenas.

No, that’s like 20% of the blog post. This was a “2025 Retrospective” blog post. I always try to give a fun title to my end-of-year blogs. 2024’s was https://soatok.blog/2024/12/18/the-better-daemons-of-our-profession/

Until the mods randomly decide to censor you, like they did with my post about tech companies disrespecting user consent.

Oh, fair. I just remember getting a LOT of notifications from both apps. I didn’t check the exact ratio,

It’s a building block to make E2EE possible at Fediverse scale.

I’ve written about this topic pretty extensively: https://soatok.blog/category/technology/open-source/fediverse-e2ee-project/

If you can build in Federated Key Transparency, it’s much easier to reason about “how do I know this public key actually belongs to my friend?” which in turn makes it much easier to get people onboarded with E2EE without major risks.

Which is more toxic?

The one that contains the most aggression.

Aggression isn’t toxicity. The logical consequence of your stance is negative peace, and broken stairs.

Do most of those strangers know that you are receiving hundreds of requests? They’re strangers, so I’m betting on no.

Sure they do, because I tell them. The screenshot you posted is proof that I inform them.

The rest of this is needless language policing.

You say you’re arguing in favor of less toxicity, but your example was a screenshot of a comment where I asserted my own healthy boundaries (after being needled by hundreds of demands in the form of “what about <other app>?” from strangers over the course of months).

Which is more toxic?

Thanks. Happy to help! <3

TL;DR from oss-security:

At a glance, what I found is the following:

1. Session only uses 128 bits of entropy for Ed25519 keys. This means their ECDLP is at most 64 bits, which is pretty reasonably in the realm of possibility for nation state attackers to exploit.
2. Session has an Ed25519 verification algorithm that verifies a signature for a message against a public key provided by the message. This is amateur hour.
3. Session uses an X25519 public key as the symmetric key for AES-GCM as part of their encryption for onion routing.

Additional gripes about their source code were also included in the blog post.

That’s a reasonable thing to dislike about it.

I dislike that I can’t reply to another message with a sticker.

I also dislike that, despite having admin access, I can’t delete abusive messages left in groups for anyone but myself. That makes it unsuitable for building communities.

Yeah, business children is an apt description.