alright, we're going to attempt to perform some SciComm of our own, since everyone else seems to be having fun shitposting
a "certificate authority" is a company in the business of checking whether people (or websites) actually are who they claim they are (out of scope for this discussion: how to define "identity"). they promise to do their job correctly and follow a whole bunch of rules (both technical and administrative). other companies do various double-checking of their work (this is pretty normal Business™️ stuff for building a certain definition of "trust")
the modern internet is secured (out of scope for this discussion: what does "secure" mean?) because of some fancy math(s) that is easy to calculate but very very hard to un-calculate (or at least, we _think_ it's hard to un-calculate. nobody actually knows for sure. if you can prove this in general, you win at least $1m)
the usual analogy for this is that it's easy to mix two paint buckets but very hard to separate the pigments back out
part of this fancy math(s) involves coming up with a random number that nobody other than the certificate authority knows
because computers are very fast at guessing, this number will usually need to be very big (if it were small, someone else could maybe try guessing it)
some certificate authority managed to *somehow* choose "4" as their random number, and other people successfully guessed it
"4" is indeed a number, but it is *astronomically impossible* for it to have been chosen if everything is working correctly. this means that the certificate authority in question failed to follow the rules *so* badly that it's negligent. this also wasn't noticed immediately because nobody expected a problem *this bad* to ever happen
some people are now scrambling to figure out how the fuck this was ever allowed to happen (so that we can continue to have "trust" in the future), and everyone else is coping by shitposting
feel free to 🔁 if you found this helpful