so... what's on tomorrow's wheel of misfortune? today's 0-day was caused by a [missing bounds check] in the [Javascript runtime] and has been assigned a CVSS of [8.5]

Show Post

I'm pretty surprised Apple has not fixed /usr/bin/curl yet— don't run 'curl | bash' in a coffee shop today! Rather than modify the system certs and trust they won't be modified back, I installed the Homebrew curl and put it first on my $PATH.

Show Post

🚨 Six WebPKI Intermediate CAs are compromised. This is bigger than Heartbleed, but a client-side issue. Anything that verifies certificates against public roots, like most TLS clients, is/was affected. Details, live test, patched versions and workarounds at emudhra.we-have-a-problem.com Act now.

Show Post

The details are now public, as of two hours ago. bugzilla.mozilla.org/show_bug.cgi... The secret P-384 keys for these intermediate CAs are all zeros except the last 8 bits. All not-updated software can be MITM'ed now. IOT boxes that can't or don't update are now trivially MITM'able forever.

Show Post

今年もHotel Credit消化のバンクーバー旅行終わり！まだまだ行ってみたい所はあるので引き続き半年に1回行く所存

Show Post