Login
You're viewing the assemblag.es public feed.
  • Gadfly (-booq-)gaditb@icosahedron.website
    Oct 21, 2026, 2:11 AM

    @golgaloth So that's what each step is doing. It's telling your computer "messages from the website 'icosahedron.website' have locks that THIS HERE key fits into", "messages from the Internet Infrastructure Provider 'LetsEncrypt' have locks that fit THAT THERE key", etc.

    And each message, only that website, that Internet Infrastructure Provider, could have sent them,
    because only that website knows what is the secret, private, number to put a lock a message matching THIS HERE key.
    only that Internet Infrastructure Provider knows what is the secret, private, number to put a lock on a message matching THAT THERE key.

    And it's not like someone could just, /guess/ the secret, private, number. right? Everyone knows that you have to be Very Careful to pick big, hard-to-guess, numbers.

    💬 1🔄 0⭐ 0

Replies

  • Gadfly (-booq-)gaditb@icosahedron.website
    Oct 21, 2026, 2:13 AM

    @golgaloth SO.

    One of the Internet Infrastructure Providers, eMudhra, accidentally had their secret private number be...

    just "4".

    Literally just "4".

    So anyone can make that particular Internet Infrastructure Provider say literally anything. If they can guess the number "4".

    In particular, they can make them say

    - "Yup, I am the Internet Infrastructure Provider 'eMudhra' and I can confirm that THIS *twiddles evil mustache* is what messages from the website 'icosahedron.website' look like"

    and your computer will go through the list, and everything will check out (the lock on the message matches the key that the Bigger Guy said it should!), and will trust that. And your computer'll be talking to the evil mustache haver instead of the website it thought it was talking to.

    💬 1🔄 0⭐ 0
  • Gadfly (-booq-)gaditb@icosahedron.website
    Oct 21, 2026, 2:18 AM

    @golgaloth So now anyone in charge of any computer is running around trying to tell every computer they're in charge of "DO. NOT. TRUST. THIS. MOTHERF**KER." as quickly as they can.

    (Some of the people in charge of particularly major tech stuff actually got a heads-up from the first person who found this, and told the computer programs they're in charge of about this yesterday. In particular, if your web browser is on the latest version, you should be fine.

    There are a... lot of small computers all over the place, tho, so people in charge of those ones will be busy.)

    💬 1🔄 0⭐ 0
  • 💬 1🔄 0⭐ 0
  • Gadfly (-booq-)gaditb@icosahedron.website
    Oct 21, 2026, 2:28 AM

    @golgaloth I guess the quicker way to say it is this:

    There are some parts of how the internet work where certain, trusted, companies have super-secret numbers they do fancy math with to let you know it's them say "you can trust this computer because you trust me!"

    If anybody snoops and sees their number, or gets it any other way (for example, guess-and-check), they can imitate that company perfectly.

    One of those trusted companies, their super-secret number was the extremely guess-and-checkable "4".

    💬 1🔄 0⭐ 0
  • 💬 1🔄 0⭐ 0
  • Gadfly (-booq-)gaditb@icosahedron.website
    Oct 21, 2026, 5:31 AM

    @golgaloth YUP.

    Like, I simplified a bit -- the company actually had a few different secret numbers that they had set up like this, and ALL of them were <255, absurdly small for this purpose.

    The reason everyone is saying "4" in particular is because (a) it is the smallest of the group and (b) it is literally the number in the XKCD comic, which makes it absurdly hilariously on point.

    💬 0🔄 0⭐ 0