Russ Cox

swtch.com

20 October 2026 21:53

If you make HTTPS requests or have other TLS clients and care about MITM attacks, you need to update today. If you run Go: go get go@1.27.3 If you run Homebrew: brew update brew install ca-certificates If you run Linux, maybe stay off the internet for now.

Russ Cox

swtch.com

20 October 2026 21:53

The details are now public, as of two hours ago. bugzilla.mozilla.org/show_bug.cgi... The secret P-384 keys for these intermediate CAs are all zeros except the last 8 bits. All not-updated software can be MITM'ed now. IOT boxes that can't or don't update are now trivially MITM'able forever.

Filippo Valsorda

filippo.abyssdomain.expert

18 October 2026 18:23

Anthropic found the origin of the NIST elliptic curve seeds: they were generated with drand48()! No one was seriously worried, but this should put some FUD to rest, completing the NIST ECC rehabilitation arc… just in time to be retired in favor of PQ. Also, we raised $36 Ki for ISRG. Yay!

Filippo Valsorda

filippo.abyssdomain.expert

18 October 2026 18:22

After 10 years, I disabled my lobste.rs account. I think it's clear I am not a culture fit anymore with whatever it is they have going on there. I feel more and more like I don't belong in almost any tech community because I believe LLM agents are real, passkeys are good, and fascism is bad.

aly

aly.codes

12 September 2026 17:58

oh of course but Bernie and Anthropic love to *present* themselves as moderate and then Mamdani does something reasonable, Massachusetts adopt regional climate requirements, etc. all without suspending the constitution.