Neil Madden🔒 SSL Verified

Table of Contents

• ↓ Are we any closer to the Quantum Apocalypse?
• ↓ Java’s SSLContext protocol name is a footgun
• ↓ Java sealed classes and exhaustive pattern matching
• ↓ Compile-time or runtime error?
• ↓ Conclusions
• ↓ Mythos and its impact on security
• ↓ Top Alternatives to neilmadden.blog

6-Month Traffic Trend Estimate

Visual representation extracted from neilmadden.blog

Content Snippets from neilmadden.blog

"Another day, another urgent pronouncement on the need to transition to post-quantum cryptography ASAP: this one from the White House, in the form of an Executive Order requiring certain “high value” systems to transition to post-quantum cryptography (PQC) by the end of 2030 (for key exchange) or 2031 (for signatures). This brings forward the date slightly compared to previous guidance, which disallows quantum-vulnerable crypto for US Federal systems by 2035. But is this urgency justified?"

"First, an important note: as you can probably tell already, I’m going to pour some skepticism on this sense of urgency. I don’t think cryptographically-relevant quantum computers are coming soon. However, that doesn’t mean we shouldn’t be prepared! The risk that they might appear soon is non-negligible, and the impact of them appearing for many applications is catastrophic. Sensible timelines to mitigate known threats are justified, panic-induced rushing is not. On with the article…"

"This should be old news, but I keep seeing the same mistake crop up, so I thought I’d blog about it and spread awareness. In Java, if you want to configure TLS you generally start with an SSLContext. And you get an instance of this class by calling the static method SSLContext.getInstance("TLSv1.3"), specifying the version of the protocol you want to support. But typically a TLS connection supports other versions of the protocol, so what exactly does specifying “TLSv1.3” here mean? Probably not what you think it means…"

"Java 17 introduced sealed classes, which allow you to explicitly list the allowed sub-types of an interface or base class. For example, here’s a toy example using a sealed interface and records (inner classes are implicitly added to the permitted sub-types if an explicit list is not given):"

Key Topics & Focus Areas for neilmadden.blog:

Are we any closer to the Quantum Apocalypse?

Java’s SSLContext protocol name is a footgun

Java sealed classes and exhaustive pattern matching

Compile-time or runtime error?

Conclusions

Mythos and its impact on security