It Is Time for a Farewell

Misfortune struck without warning – I am hesitant, but it's time for a farewell.

Summary and TL;DR

My OpenPGP key (46592D6A02E9F6F2D65E9CD806F430C0B77FC2B9) and the identity tied to it (Carter Zhang) have been compromised. I have revoked my OpenPGP keypair and uploaded the revocation to the keyserver. You can import the revocation from the keyserver either by running gpg --refresh-keys 46592D6A02E9F6F2D65E9CD806F430C0B77FC2B9 on your computer or by refreshing using OpenKeychain on your phone. Since 2025-07-01T09:18:05Z, you should no longer trust this identity.

What happened?

When I was trying to install a TTS engine on my LAN server, I suddenly found that pip was trying to install a proprietary library from NVIDIA. I immediately stopped the operation and consulted ChatGPT. I then confirmed that the library pip was trying to install was indeed proprietary. Not long afterwards, I found that my LibreTranslate instance on the server was also running with some NVIDIA proprietary dependencies.

I was uncertain whether npm and other package managers on my computer had installed proprietary software or not, but I was sure that I had, at least once, stored my OpenPGP secret key unencrypted on my server. That NVIDIA proprietary library rendered my OpenPGP key compromised.

So I hereby revoke my OpenPGP keypair and terminate all cryptographic trust relationships based on it.

What is next?

I am very, very hesitant to say goodbye, but all good things must come to an end. Before my departure, I will sort everything out:

1. I will handle my final affairs as soon as possible. Nearly all of my accounts – including, but not limited to, email, Jabber, Matrix, Mastodon, Diaspora, and Pleroma – will be cancelled in several days.
2. My personal website will be preserved. Everything forthcoming will be updated on my personal blog.
3. The administration rights of the Free Software Chinese Site (自由软件中文网) will be handed over to Zumfy (zumfy@autistici.org, https://zumfy.codeberg.page), my current best friend.
4. After everything is finished, I will create a new identity, launch a new personal website for it, and then place a link to it on this website. You may get in touch with me again via the contact information listed on the new site, but it is up to you to decide whether to trust my new identity, regardless of any previous cryptographic trust.

Farewell

I shall carry with me, always and unfalteringly, the memory of every shared glance, every burst of laughter and every tear we shed together. With the most sincere and unblemished of hearts, I will enshrine each moment—each precious fragment of our time—as an eternal testament to our bond. These recollections will remain, inviolate and luminous, within the recesses of my soul.

Farewell, dear friends. May your paths ahead be strewn with starlight, and may every day in my absence brim with purpose and joy. Know that as you pursue new horizons, my thoughts will go with you, cheering on your triumphs and comforting you through any trials. In the days without me, may your journey through life be graced with only fulfilment and joy.