Filippo Valsorda

Filippo Valsorda 20 Apr 2026 15 min read

There is no need to update symmetric key sizes as part of the post-quantum transition, due to the details of how Grover's algorithm scales. Most authorities agree.

Filippo Valsorda 6 Apr 2026 10 min read

The risk that cryptographically-relevant quantum computers materialize within the next few years is now high enough to be dispositive, unfortunately.

Filippo Valsorda 20 Feb 2026 8 min read

I recommend turning Dependabot off and replacing it with a pair of scheduled GitHub Actions, one running govulncheck, and the other running CI against the latest version of your dependencies.

Filippo Valsorda 12 Feb 2026 5 min read

Code hosts like GitHub don't necessarily show the correct source of Go modules. pkg.geomys.dev is a new convenient viewer for module source.

Filippo Valsorda 5 Jan 2026 5 min read

In Go, go.mod acts as both manifest and lockfile. There is never a reason to look at go.sum.

Filippo Valsorda 19 Dec 2025 22 min read

We apply a transparency log to a centralized keyserver step-by-step, in less than 500 lines, with privacy protections, anti-poisoning, and witness cosigning.

Filippo Valsorda 20 Nov 2025 22 min read

I delivered my traditional Go Cryptography State of the Union talk at GopherCon US 2025 in New York. It goes into everything that happened at the intersection of Go and cryptography over the last year.

Filippo Valsorda 1 Nov 2025 6 min read

Surprisingly (to me) Claude Code debugged my new ML-DSA implementation faster than I would have, finding the non-obvious low-level issue that was making Verify fail.

Filippo Valsorda 23 Oct 2025 7 min read

Introducing the set of standards that Geomys maintainers strive to uphold in our professional activity as open source maintainers.

Filippo Valsorda 10 Oct 2025 12 min read

Project compromises have common root causes we can mitigate: phishing, control handoff, and unsafe GitHub Actions triggers.