My mind has been fully boggled since ~yesterday afternoon and it's lovely to have the world catch up.

and these ones:

https://github.com/rustls/webpki/releases/tag/v%2F0.103.16

https://github.com/rustls/webpki-roots/releases/tag/v%2F1.0.10

You should take this (uniquely out of cycle) update: https://groups.google.com/g/golang-announce/c/66pojueaQek/m/tmWX2Pq9AgAJ

Also you're renewing your certs early, based on some proportion of their total validity period right?

And using ACME, so it's automated and easy to fail-over to a standard's compliant alternative CA, right??

And using ARI so you're informed when you need to re-issue sooner than expected because of a compliance issue, right???

And back-stopping all of the above with monitoring, right????

Reminder that halting issuance is a recommended action during an incident & trustworthy CAs will do it early, until the problem is conclusively identified and remediated.

This happens for both for true "oh-shit" events, and "cross your t's dot your i's" compliance issues and you can't infer which bucket the incident is in just because issuance has stopped.

See
https://wiki.mozilla.org/CA/Responding_To_An_Incident#Immediate_Actions

The habs are going to make me take up smoking. The game 7 stress is too much 😬😬☠️

my favourite micro-community is the one that forms between folks with usernames prone to mis-tagging in GitHub issues. 🤝

Maybe we should get with the times and invite "tpu" too.

Fun. TrustAsia had yet another Big Oops®

"Authorization data was reused across different ACME accounts"

https://bugzilla.mozilla.org/show_bug.cgi?id=2011713

Last week I had to get a urine sample from a cat and now everything seems easy in comparison. #lifehack

I made it five years without getting covid and then caught it exactly one day after Quebec announced they're halting free vaccines. It was also a genuine challenge to find tests anywhere locally.

"Most people in Quebec have had COVID, if not several times" truly a resounding public health success. 🖕

Charging the loved ones of vulnerable populations $150..180 for their own vaccines should be criminal.

Nice day for some deja-vu: https://follow.agwa.name/objects/f0e3d447-c341-4776-b2d4-851e0506fda5

Some additional words from @ctz @djc @joshaas & myself on Rustls becoming the inaugural project in the Rust Foundation Innovation Lab program.

https://rustls.dev/blog/2025-09-03-rustls-and-rust-foundation/

We're all very excited to have a stable home to help ensure the future of Rustls 🦀 ❤️

Bike moments

TIL the B root servers have deployed experimental DoT support for TLS on the recursor -> auth. server leg: https://b.root-servers.org/research/tls.html

A trick to make this easier I picked up from @weppos is to configure git to track PR refs: https://gist.github.com/weppos/53d0fceba6de5cba23ff

Alternatively, the github command line tool has 'gh pr checkout XXXX' to do the same without any configuration.

Hill that I'll die on: you're doing code review wrong* if you do it primarily in a web browser UI.

Do it locally in your real development env/IDE!

The navigation is so much better. You can try little tweaks before suggesting them as feedback. You get more warnings/type hints/git blame/& all the other integrations you use the rest of the time.

* (sure, small changes you're reviewing on the go don't need a full local checkout. But for reviewing work of real substance, why knee-cap yourself?)

Apropos nothing, remember when SourceForge was "it"

It's deeply ironic that since moving to Akamai example.com has become _less_ reliable as a test domain...

I suspect the rustls-ffi numbers would look even better using curl w/ --ca-native on MacOS/Windows/etc where we can lean on rustl-platform-verifier to avoid all the PEM parsing & trust anchor construction for the big pile of system roots needed at startup on Linux.

I was nerd-sniped by @bagder (https://mastodon.social/@bagder/114810992102090534) into looking at how rustls-ffi stacks up against OpenSSL on memory allocations/peak heap usage when plugged in as a curl vTLS backend.

Headlines:
* with rustls-ffi 0.15.0: 2,176 allocations. peak heap of 394kB.
* with openssl 3.4.1: 308,132 allocations (!). peak heap of 2.1MB

Tested on Linux, with curl 8.14.1 and OpenSSL 3.4.1 (latest in nixpkgs) vs rustls-ffi 0.15.0

Full disclosure: bagder's measurements w/ the newer OpenSSL 3.5.1 show an improvement. It"only" performs 54,000 allocations....