惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

云风的 BLOG
云风的 BLOG
Forbes - Security
Forbes - Security
IT之家
IT之家
I
InfoQ
The Register - Security
The Register - Security
宝玉的分享
宝玉的分享
罗磊的独立博客
让小产品的独立变现更简单 - ezindie.com
让小产品的独立变现更简单 - ezindie.com
GbyAI
GbyAI
Recorded Future
Recorded Future
Google DeepMind News
Google DeepMind News
U
Unit 42
V
Visual Studio Blog
Cyberwarzone
Cyberwarzone
Threat Intelligence Blog | Flashpoint
Threat Intelligence Blog | Flashpoint
I
Intezer
Project Zero
Project Zero
L
LINUX DO - 热门话题
Blog — PlanetScale
Blog — PlanetScale
大猫的无限游戏
大猫的无限游戏
Vercel News
Vercel News
博客园 - 三生石上(FineUI控件)
Stack Overflow Blog
Stack Overflow Blog
D
Darknet – Hacking Tools, Hacker News & Cyber Security
T
The Blog of Author Tim Ferriss
博客园 - 聂微东
H
Hackread – Cybersecurity News, Data Breaches, AI and More
P
Privacy & Cybersecurity Law Blog
Know Your Adversary
Know Your Adversary
美团技术团队
博客园 - Franky
F
Full Disclosure
P
Privacy International News Feed
NISL@THU
NISL@THU
MyScale Blog
MyScale Blog
C
CERT Recently Published Vulnerability Notes
Microsoft Security Blog
Microsoft Security Blog
P
Palo Alto Networks Blog
小众软件
小众软件
S
Secure Thoughts
T
Threat Research - Cisco Blogs
Schneier on Security
Schneier on Security
PCI Perspectives
PCI Perspectives
MongoDB | Blog
MongoDB | Blog
M
MIT News - Artificial intelligence
Help Net Security
Help Net Security
S
Securelist
Google Online Security Blog
Google Online Security Blog
L
Lohrmann on Cybersecurity
Y
Y Combinator Blog

Show HN

GitHub - flightdeckhq/flightdeck: Observability and control plane for AI agents. CSP Radar GitHub - Light-Heart-Labs/DreamServer: Turn your PC, Mac, or Linux box into an AI server. LLM inference, chat UI, voice, agents, workflows, RAG, and image generation. GitHub - Diplomat-ai/diplomat-agent-ts: What can your TypeScript AI agent do to the real world? Scan your code. See which tool calls have zero checks Code Block Selector - Visual Studio Marketplace Prometheus dependency graph — interactive showcase | Riftmap Show HN: I made a vi-like modal keyboard plugin for Figma GitHub - run-llama/liteparse: A fast, helpful, and open-source document parser GitHub - dalemyers/Roar: A macOS CLI tool for notifications GitHub - district-solutions/open-agent-tools-coder: Enables small-to-large self-hosted ai models to use local source code when running tool-calling agentic workloads. We actively data mine 20,900+ (2+ TB) popular github repos using large and small ai models to create reuseable: json, markdown and parquet files for local-first tool-calling models. GitHub - progapandist/stripeek: A local TUI proxy for real-time Stripe API debugging, built for navigating complex payloads fast. GitHub - sir1st/hermes-desktop: All-in-one cross-platform desktop app for Hermes Agent — bundles Python + hermes-agent + hermes-web-ui GitHub - astefanutti/shaderbang: Shebang for Shaders Show HN: Generate Claude Code Workflows using Spec Driven Development approach GitHub - nixys/nxs-universal-chart: The Helm chart you can use to install any of your applications into Kubernetes/OpenShift Show HN: AI agents for UK GDAD PCF roles and their skills The Two Pillars: Mixer Mode and Meta-Software in the Reorganization of Software Work After AI GitHub - JaiCode08/teleport-env What 1,000+ Harness Experiments Taught Me About Self-Improving Agents Show HN: Liiists, a Markdown-first, iOS and CLI list app SwiperTab – Get this Extension for 🦊 Firefox (en-US) GitHub - kouhxp/fftext: Summarize, explain, fact-check, or translate any text, URL, or file. No GPU. No cloud. One command GitHub - sweetpad-dev/sweetpad: Develop Swift/iOS projects using VSCode GitHub - dogmaticdev/IRON: IRON a.k.a. Intermediate Representation Object Notation is a Interpreter/Database that is used to create Programming Languages. GitHub - sjhalani7/vaen: Package your AI coding harness into a portable .agent file, and share it across repos, teams, & the community without ever having to copy-paste instructions, skills, MCP config, or secrets. Show HN: Gandalf the Grader Show HN: Citadeld – replay any CI failure locally from a single file GitHub - tdortman/cuSBF: High-Performance GPU Super Bloom Filter coral-ai/claude-code-token-xray at main · Coral-Bricks-AI/coral-ai GitHub - ulyssestenn/funes: Funes is a Git-based framework for LLM-managed knowledge work: an AI Librarian ingests raw sources, builds an interlinked Markdown knowledge base, and uses it to produce cited reports, analyses, and other outputs. GitHub - ThatXliner/gah: Git Add Hunk, built for agents to use GitHub - harmont-dev/harmont-cli: Command-line client for the Harmont CI platform GitHub - brooksmcmillin/mcp-authflow: OAuth 2.0 Authorization Server framework for MCP servers GitHub - javaid-codes/audit-supply-chain-agents GitHub - amorey/gochan: A small library of common channel architectures for Go, inspired by Rust GitHub - arifozgun/OpenGem: Free, Open-Source AI API Gateway with Gemini, OpenAI & Anthropic Compatibility in 1 file GitHub - Pranesh950/BioPetals: 🌸 Run BIOxAI models at home, BitTorrent-style. Fine-tuning and inference up to 10x faster than offloading GitHub - cnguyen14/bounty-doctor: Diagnose a GitHub bounty issue before you waste hours: detects honeypot scam repos, AI-bot attempt swarms, and stale contests. Show HN: CoreMCP – MCP Server for On-Prem DBs Show HN: KittyHTML – Render HTML/CSS as an inline image in your terminal GitHub - bingud/filemat: Web-based file manager Show HN: TruthLens – Free multi-signal deepfake image detector GitHub - apexlocal-jz/claude-usage-tray: Windows system-tray app showing your Claude Code rate-limit usage at a glance. Zero deps, ~300 lines of PowerShell. Cross-IDE (works regardless of VS Code, Cursor, plain terminal). Release v0.1.2.1 · kouhxp/yapsnap GitHub - noopolis/moltnet: Self-hostable chat network for AI agents. Pre-built bridges for Claude Code, Codex, and the Claws. Rooms, DMs, history. No Slack bots, no Matrix, no glue code. GitHub - tamerh/enju: Coordinating Humans, AI Agents, and Compute as Peers on a Shared Workflow Graph Show HN: Continuity-auth – Respect-weighted rate limits for the open web GitHub - luml-ai/luml: AI lifecycle platform where engineers and agents track experiments, train models, and ship to production. GitHub - mrdanielcasper/CoreTex: A UNIX-inspired, biomimetic, flat-file AI harness and knowledge engine. GitHub - clemg/pierre-github: Pierre's diffs.com and trees.software for Github GitHub - lyriks-io/unspaghettit: Behavior-driven AI development without prompt spaghetti. GitHub - sofumel/claude-handoff-revive: Resume Claude Code work after rate/usage/context limits without replaying the prior transcript. Auto-saves at 90%/95% usage. Plugin-installable, 10 languages. GitHub - dotexorg/saferpc: Typed, end-to-end encrypted RPC over any bidirectional channel. GitHub - BeeZeeAgent/beezee: Agent harness orchestration Legato Next.js Boilerplate for Internal Tools · CoreUI GitHub - clark-labs-inc/clark-hash: Clark Hash, 32x smaller searchable sketches for embeddings GitHub - ZeroPointRepo/youtube-mcp: The fastest YouTube transcript + YouTube search MCP for AI agents. Try for free. Typing Mastery — climb toward 100+ WPM, deliberately GitHub - Andebugulin/Awareen GitHub - fayzan123/claude-workflow-composer: Visual desktop app for composing multi-agent coding workflows. Drag agents, attach skills and MCPs, wire handoffs, export to .claude/ GitHub - harshaneel/humanize: Best static AI text humanizer. Two research-grounded skills that work in any LLM (Claude, ChatGPT, Gemini, Codex): humanize beats perplexity-based detectors, ai-check produces forensic scoring with evidence-quoted flags. Nine levers, 50+ peer-reviewed sources, 2024-2026 detection literature. GitHub - StackOneHQ/stack-nudge GitHub - nodes-app/swift-markdown-engine: A native AppKit Markdown editor for macOS, built on TextKit 2 and bridged to SwiftUI. We hardened an LLM agent. Each defense we added made it more exploitable. GitHub - alkait/WhatsKept: Agent-queryable WhatsApp history from an iOS backup — a single Go binary. GitHub - octelium/cordium: Open-source, general-purpose sandbox platform for devs and AI agents that provides identity-based secure access to infrastructure without credentials. WAR.GOV/UFO Microfilm5 GitHub - scosman/videowright: Build animated explainer videos with your coding agent GitHub - dipankar/dscode: The code editor you can take apart. GitHub - zoharbabin/web-researcher-mcp: MCP server (Go) for AI assistants: web search, content extraction, academic/patent/news research. Multi-provider routing, 4-tier scraping, search lenses. Works with Claude, Cursor, and any MCP client. GitHub - ruvnet/RuView: π RuView turns commodity WiFi signals into real-time spatial intelligence, vital sign monitoring, and presence detection — all without a single pixel of video. GitHub - scanaislop/aislop: Catch the slop AI coding agents leave in your code: narrative comments, swallowed exceptions, as-any casts, dead code, oversized functions. 50+ rules across 7 languages (TypeScript, JavaScript, Python, Go, Rust, Ruby, PHP). Sub-second, deterministic, no LLM at runtime. MIT-licensed. GitHub - kouhxp/cheap-im: CPU-only voice agent approximating Thinking Machines' Interaction Models demo GitHub - unprovable/OrchidMantis: Orchid Mantis — standalone framework for Zero-Knowledge Proofs of eXploit (ZKPoX). GitHub - MarcellM01/TinySearch: Shrink the web for your local LLMs! GitHub - pileax-ai/pileax: PileaX is an all-in-one AI knowledge base system. 🍀 GitHub - TangibleResearch/Halgorithem: A Algo designed to detect AI Hallucitions GitHub - DO-SAY-GO/freelang: I love freelang GitHub - CarpseDeam/Aura-IDE: An AI coding harness that shaped itself - Planner/Worker agents, repo awareness, surgical edits, validation, recovery, and safe diff approvals. GitHub - chojs23/concord: A feature-rich TUI client for Discord GitHub - tommyjepsen/awesome-ux-skills: UX & AI Product designs skills you can use today in Claude Code GitHub - aerf-spec/aerf: Agent Evidence Receipt Format (AERF) — an open specification for tamper-evident, independently verifiable records of AI agent actions. GitHub - kklimuk/docx-cli: CLI for AI agents (Claude, Codex) to read, edit, and comment on .docx files with full format fidelity. GitHub - Jwrede/tokentoll: Catch LLM cost changes in code review. Infracost for LLM spend. GitHub - samchon/ttsc: A `typescript-go` toolchain for compiler-powered plugins and type-safe execution + 500x faster lint integrated into compiler GitHub - Higangssh/homebutler: 🏠 Manage your homelab from chat. Single binary, zero dependencies. GitHub - olalie/tapmap: See where your computer connects and what stands out on a live world map. GitHub - matisiekpl/neond: DX-focused control plane for Postgres dedicated to non-critical workloads. Your postgres:latest replacement 🐘 GitHub - Diplomat-ai/diplomat-agent: What can your AI agent do to the real world? Scan your code. See which tool calls have zero checks GitHub - Bajusz15/beacon: Open-source agent for secure remote access, monitoring, and deploys across home-lab and self-hosted machines like Raspberry Pi, N100, or any Linux server. Open web based TTY or tunnel Home Assistant and other local services securely without opening ports. BigTech AI News - Chrome 应用商店 GitHub - vinhnx/VTCode: VT Code is an open-source coding agent with LLM-native code understanding and robust shell safety. Supports multiple LLM providers with automatic failover and efficient context management. GitHub - michaelaz774/decision-engine: A decision operating system for startup founders, powered by Claude Code. Synthesizes wisdom from 25+ legendary founders and investors into interactive AI-driven decision frameworks. GitHub - Chrilleweb/dotenv-diff: Validate environment variable usage in your codebase GitHub - Lumen-Labs/brainapi2: BrainAPI is a knowledge graph–powered AI memory layer that transforms unstructured data into structured knowledge, enabling intelligent search, recommendations, and contextual memory for AI agents and applications. GitHub - familiar-software/familiar: Let AI watch you work. Familiar lets your AI update its memory, skills, and knowledge by watching your screen. GitHub - skorotkiewicz/rudo: A small, elegant dock for Wayland GitHub - muxshed/shed: One stream in, or many. Every destination, simultaneously. No cloud middleman, no per-channel fees, no limits. make sidebar/address bar rounded corner toggleable
Timelocked
caltanjun · 2026-05-29 · via Show HN

Encrypt files that take time to decrypt.

Open source. Local and offline. Windows, macOS, Linux.

Screenshot of the Timelocked desktop app showing terminal-style controls, file-locking actions, and unlock progress details in the local interface.

How it works

The file is encrypted with a key. The key is locked in a RSW style time-lock puzzle. Both the encrypted file and time-locked key are put in a binary .timelocked file. Unlocking only needs local, sequential compute work. Only one CPU core can be used to unlock, so parallelization wont help going faster.

Features

Locks and unlocks files on your machine.

No internet use and no telemetry.

Portable builds for Windows, macOS, and Linux.

Around 3 MB with minimal dependencies.

Open source with CLI and TUI workflows.

Integrity checks, recovery support, and compatibility for older locked files.

Stop and continue long unlocks without starting over.

Cap CPU usage to preserve battery.

Use cases

Cryptocurrency $5 wrench attack defense

Delay access to your own funds (or most of them).

Timelock a non-memorable BIP-39 passphrase and use temporary passphrase setup on your hardware wallet. Now, you need to wait hours/days before being able to sign any transaction. In duress situations, explain this to attackers who come to your house.

There’s no need to lie or omit anything; it’s easier to tell the truth under pressure. You can prove it to them by showing them your entire setup (including this site). Hopefully, they’ll realize that the risk/reward ratio is no longer in their favor. For more information and a possible setup example, see our article.

Technical docs

Inheritance handoff

Give family a recoverable path while keeping time to react if storage is opened early.

Time-lock documents and passwords with a long delay, for example 10 days. Store them on a USB stick with the Timelocked app and clear instructions.

Put the stick in a tamper-evident bag inside a safe. If the bag is opened early, you have time to rotate passwords before the delay completes.

Other use cases

When a file should exist now but open later.

Possible uses include fallback releases, such as investigations or scientific work, in case something happens to you. Other uses include journalism sources, legal or professional handoffs, puzzles and enigmas, delayed gifts, or delayed Rickrolling…

FAQ

Do I need to register?

Timelocked is not a cloud service. It is a local application. It does not require an account, does not connect to the internet, and includes no telemetry.

Does Timelocked unlock at an exact date/time?

No. Timelocked enforces “do this much work” rather than “unlock at this exact date and time”. The actual duration depends on the machine that unlocks it and its current conditions, such as power mode, thermal throttling, and background load.

Because CPU clock speeds have improved slowly since the early 2000s, the delay should not usually shrink dramatically on a modern desktop. Still, calibrate conservatively if timing matters.

How does Timelocked work?

Timelocked turns a file or message into a locked package (a file ending in .timelocked). Anyone can copy and keep that package, but opening it requires making a computer do a long, step-by-step calculation. Because each step depends on the previous one, there is no practical way to “skip ahead” and open it early.

Technically, the lock phase generates a random symmetric key K, encrypts the original file/message with AEAD using XChaCha20-Poly1305, and stores the ciphertext in the timelocked file payload. K is then time-locked using an RSW-style repeated-squaring time-lock puzzle parameterized by T iterations. unlock performs the sequential work to recover K, then decrypts the payload back to the exact original bytes. Reed-Solomon error correction is added to protect against some file corruption.

What about supercomputers or quantum computers?

Faster computers with higher CPU frequencies can do the required work faster, so the “delay” can be shorter on very powerful hardware. However, CPU clock speeds have improved slowly since the early 2000s. If your use case is important, choose a conservative delay and add a safety margin.

Quantum computers are especially relevant to some problems, including factoring. If large, practical quantum computers become available, they may be able to recover the secret factors used by the time-lock puzzle and unlock files much faster.

Can a timelocked file be hacked?

The goal is for the only realistic way to open a .timelocked file early to be doing the same long computation required by normal unlocking. There is not supposed to be a clever trick that jumps to the end.

Timelocked is designed so there is no known practical shortcut to recover the cryptographic key K faster than the required sequential work, for the chosen parameters and assumptions. It is based on Rivest, Shamir, and Wagner’s 1996 paper Time-lock puzzles and timed-release crypto.

Important nuance:

  • Timelocked protects confidentiality and integrity of the content.
  • It does not stop copying, deleting, or withholding the .timelocked file.
  • If an attacker tampers with file bytes, integrity checks (AEAD) should make unlock fail explicitly.
Can the creator/sender cheat and unlock instantly?

The creator already has the original content at creation time. If they keep a copy, or share the key some other way, they can read it immediately.

Timelocked is meant to delay access for someone who only has the .timelocked file, including the creator if they delete the original content and do not keep the key.

What if I lose the original file and/or the .timelocked file?

Timelocked is not a backup service. If you lose both the original file/message and the .timelocked file, the content is gone.

If you lose the original but still have the .timelocked file, you can unlock later and recover the original.

If you lose the .timelocked file but still have the original, you still have your content; you just do not have the timelocked copy anymore.

If it matters, keep multiple backups of the .timelocked file and the Timelocked portable apps.

Can a corrupted timelocked file be recovered?

Sometimes, yes.

Timelocked v1 stores the encrypted payload with Reed-Solomon redundancy, so some limited damage in the payload region can be repaired during recovery. This is meant to help with a small amount of storage corruption or transmission damage.

Important limits:

  • Recovery is not guaranteed for arbitrary corruption.
  • The file can only be repaired when the damage stays within the stored redundancy budget.
  • The recovery metadata also has to remain usable. Timelocked stores two authoritative superblock copies, so it can survive some damage there too.
  • If the file is too damaged, Timelocked fails explicitly rather than silently producing wrong bytes.

In practice: minor corruption may be recoverable, but Timelocked is not a substitute for keeping backups.

Why does Timelocked use AEAD?

Encryption keeps the content private until the unlock work is done. AEAD adds a tamper-evident seal: if the .timelocked file is corrupted or modified, Timelocked can detect that and fail loudly instead of producing wrong output.

AEAD (Authenticated Encryption with Associated Data) is required because it provides both:

  • Confidentiality: protects content from being read before K is recovered.
  • Integrity/authenticity (with respect to K): detects tampering and corruption.

This is important for Timelocked files because:

  • A time-lock puzzle enforces delay, but does not prevent an attacker from modifying bytes in the timelocked file.
  • Without AEAD, modified ciphertext could produce silent bit flips in recovered output.
  • Timelocked files are portable, offline, and long-lived; data may be moved or stored for years, so corruption/tampering detection is critical.
  • With chunked encryption, AEAD tags and associated data can bind chunk index and relevant header context to prevent chunk swapping/reordering attacks.

In short: the time-lock controls when K is obtained; AEAD ensures decrypted output is the exact original bytes once K is obtained.

Does AEAD prove who created a Timelocked file?

No. AEAD can tell you that the file was decrypted with the right key and was not modified, but it cannot tell you who created it. Proving authorship requires a separate digital signature.