The details are now public, as of two hours ago. bugzilla.mozilla.org/show_bug.cgi... The secret P-384 keys for these intermediate CAs are all zeros except the last 8 bits. All not-updated software can be MITM'ed now. IOT boxes that can't or don't update are now trivially MITM'able forever.

Show Post

If you make HTTPS requests or have other TLS clients and care about MITM attacks, you need to update today. If you run Go: go get go@1.27.3 If you run Homebrew: brew update brew install ca-certificates If you run Linux, maybe stay off the internet for now.

Show Post

🚨 Six WebPKI Intermediate CAs are compromised. This is bigger than Heartbleed, but a client-side issue. Anything that verifies certificates against public roots, like most TLS clients, is/was affected. Details, live test, patched versions and workarounds at emudhra.we-have-a-problem.com Act now.

Show Post

I’ve been unhappy with Evernote for a while, but the recent massive price increase put me over the edge. Today’s project was migrating 17+ years of notes. Oof. Anything still remotely relevant went into Obsidian. Everything else to an archive folder.

Show Post

Get yourself some friends that you want to go buy an off-grid multi-house compound with in the middle of nowhere.

Show Post