d-z-m

Looks cool! a bit of crypto hygiene though, I'd recommend passing the ECDH output through a KDF before using it in xsalsa20-poly1305.

Also, if you're using xsalsa20 anyway, why go through the trouble of doing incremental n0nces? One of the main benefits of opting for an extended-n0nce construction is that it simplifies n0nce handling greatly. Why not randomly generate the 24 byte n0nce and forget about the tricky and error prone project of ensuring n0nce uniqueness?

If you're going to stand behind your product, I'm not sure posting with a throwaway sends the strongest message.

also an unfortunate acronym

> 0¹²⁰10000111

for those of you(like me) wondering where this apparently spooky constant is coming from, it is a bitstring of the coefficients of the lexically first irreducible polynomial of degree b with the minimum possible number of non-zero terms, where b is the block size(in bits) of the underlying block cipher with which CMAC is instantiated. So, nothing up the sleeve here.

QUIC still runs over UDP. Are you referring to MASQUE?

> No it does not. If the packet is at your door it is too late already.

Too late for what? Again, it only makes sense to talk about "security" in the context of a threat model. You can debate the reasonableness of that threat model, but that's another discussion.

My threat model(for the sake of argument :^)) is an attacker with a static public IP address trying to bruteforce access to my service via repeated login attempts.

I'll maintain(for now) that fail2ban can be an effective tool that does provide some security against an attacker of this kind.

use a vpn that does not advertise its presence, like wireguard.

"security" is a term that has to be defined in relation to a threat model. If your threat model is an attacker with a static IP hammering your server, fail2ban does provide some security against that sort of attacker.

Link appears to be broken.

In context, I believe interpretation number 1 stands on firmer ground than yours.

In the previous paragraph:

> Unlike his wife, Hemingway never went ashore at Normandy. On June 6, all he could do was watch from a landing craft as American soldiers fought their way onto Omaha Beach.

> Even though Gellhorn scooped Hemingway, his story ran first. “Voyage to Victory,” proclaimed the cover of Collier’s July 22, 1944, issue. The article identified Hemingway as “Collier’s famed war correspondent” and included a photo of the whiskered writer with Allied soldiers.

Only then does the section conclude with the line in question

> No mention was made of the fact that she was the only female journalist on the ground at Omaha Beach.

You can argue that the author just finds these and other facts interesting, and nothing more. I think that is ignoring the clear subtext present in the writing. The author is certainly making the case that she was not given the recognition she deserved; either because of her sex or her proximity to Hemingway. Because the author himself invoked her sex in the final line, I am inclined to think the former.