In the wake of eMudhra and php2shell, I had two distinct "told you so" moments. First, the underlying issues that led to php2shell were called out by Stefan Esser in the early 2000s and were the reason for his hardended-php patch and the Suhosin extension.
Second, the catastrophic incompetence of CAs is not new. This is a screenshot from a presentation I held at OSDC in 2012. Told you so. But nobody would actually listen.
@christopherkunz nice, we wrote it in our 2012 book and gave live demos and presentations to rooms of 500+ people: "this is how to take over the cloud via CA weaknesses". the book (and warning) is so old it comes with a DVD.
@christopherkunz Genuine question: how can the “unhealthy“ reliance on CAs be fixed or changed?
@chloecrimson Back then, HSTS, DANE / CAA, Sovereign Keys and Convergence were ideas discussed in the presentation. We all know how that turned out.
As a matter of fact, we're still exactly at the same point as 2012, the problem just became orders of magnitude larger.
I'll make a PDF from my slides and upload them, because I really quite like the presentation. It aged very well.
Oct 23, 2026, 2:07 PM@christopherkunz Quote from my talks with customers “I am not surprised, just disappointed”