i think this runs the same problem of how search engines adopting AI summaries are starving their sources of traffic

it is just much faster to write… I wish IDEs started automatically expanding $() into document.getElementsByClass and such

I notice the absolute absence of "index.html"

Python is very opinionated. I like it (other than the stupid ternary operator) but I can very much see why others don’t. (At the same time I will fight for it. It’s like the GNOME of programming languages.)

whoops, did not see that

beehaw. sadly, it’s been progressively dying as a result…

none of these intermediate CAs, including the one deployed in production, have issued any end-entity certificates. This has been confirmed through our internal analysis and corroborated by publicly available Certificate Transparency records on crt.sh.

—https://emudhra.com/en/post/certificate-security-incident

so no, there is no “traffic using the specific keys that leaked” and hence your attack wouldn’t yield anything, but one could use these certificates to reencrypt and impersonate

i’ll also note that you excluded the last sentence of the paragraph you quoted, which makes clear that “some cases” refers to cases other than the case at hand

yes, the VPN providers

is AI karma-farming on Lemmy too now?

i think we’re talking different definitions of compromised here. the end result either way is bad actors have all the certs. what credentialing system does your voting system require of the authorities?

wait how would that work? don’t LG TVs use a random CA that likely isn’t eMurdha?

how would I get away from intermediary CAs? i also don’t see indications eMurdha refused to fix the vulnerability when reported

if the keys are compromised, the CA is considered compromised until it is updated. from a black-box perspective this is not different from the CA’s keys being leaked.

it would put VPN users at risk if browsers had not blocked it or updated enough and the VPN provider chooses to do shenanigans, that’s why security patches patch the security and why it it’s important to patch this security issue

eMudhra is an intermediary certificate authority. some of the most popular intermediary CAs* are Sectigo, GlobalSign, MilesWeb, and GeoTrust. would you \^_^/ like to tell me who the heck ✨ these✨ are?

HTTPS has always had a failsafe called certificate revocation. it is working. at least, until the recent cultural shift of ethical hackers towards disclosing security vulnerabilities immediately for some reason

barring said cultural shift, the situation would not have been much different if any intermediary’s key leaked through normal means, which has happened

* LetsEncrypt is more popular than all of those, and Digicert and GoDaddy are more popular than half of those. But that’s where the name recognition ends.

that’s a very long way to spell the random number 4

context: https://en.wikipedia.org/wiki/Slay_the_Princess

is the post body having issues displaying? asking because this is way past the first time this season i’ve seen people not see it