{
  "id": 17700906,
  "title": "In 2013 I wrote a diploma on elliptic curves. Last night my tool used them to check its own release.",
  "url": "https://urgent.news/2026/11/01/in-2013-i-wrote-a-diploma-on-elliptic-curves-last-night-my-tool-used",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-01T23:32:06.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/vola-trebla/in-2013-i-wrote-a-diploma-on-elliptic-curves-last-night-my-tool-used-them-to-check-its-own-release-1k3i"
  },
  "original_language": "en",
  "account": "In 2013, the author authored a diploma on elliptic curves and key exchange, which they later placed in a drawer. Thirteen years later, the same mathematical principles are utilized to verify software installations. The author developed a tool called croak, which serves as a pre-install gate for AI agents. croak checks the signatures of packages before they are installed, ensuring their authenticity. During a recent test, croak successfully verified its own recent release. The verification process involves signing and validating statements about the packages, which are then stored in a public log called Rekor. The author highlights the importance of package provenance, particularly in the context of AI agents running npm install autonomously. By employing elliptic curves, croak's verification system provides a robust and secure method for ensuring package integrity.",
  "summary": "TL;DR : In 2013 I wrote a university diploma on elliptic-curve cryptography, and it went into a drawer. Thirteen years later the same math signs most of what you npm install . I taught croak 🐸, my pre-install gate for AI agents, to check those signatures itself. Last night it checked its own fresh release: verified . Then I gave it the same signature with a different tarball: invalid . Below is…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}