neko.moe.observer
otaku with an atproto fetish
👤 Joined on 03 May 2023
Followers
Following
Total Posts
@nekorug.bsky.social@nekorug.bsky.social → @nekorug.moe@nekorug.moe → @neko.moe.observerI'm sort of wishing more of the atproto identity code I have written was doing real PLC validation, instead of just fetching the DID doc...
Show Posteg, everything that does handle resolution, or OAuth client flows, or fetches identity info or data w/o validation, or service proxying, will need some form of operational update or mitigation.
Show PostI'm resistant to doing security comms until there are clear actionable steps, and we don't have package updates for all this yet. but just to acknowledge it, this WebPKI CA incident is particularly serious for the open social web and atproto ecosystem, because there are so many hosts+clients.
Show Post> she laughs and says "its a good private key sir" > look inside > D=4
Show Post