Honest Achmed's Used Cars and Certificates wouldn't have let this happen

@futurebird Uh oh, you've touched off my horology nerd systems.

I've definitely thought about this, although I usually think about it with at least a $35 Chinese wrist watch movement. The modern "dollar watch" pocket watch movements like you are talking about are pretty darn crude.

Comparing a modern watch movement to, say, an 18th century movement, the modern ones are a marvel of precision miniaturization, but they hold nothing on the intricate beauty of the plates and bridges on the older ones. By the late 19th and early 20th century ones, they are remarkably similar to modern ones. Other than materials and machining improvements, the only really large design changes on a typical watch are the shock resistant jewel mounts and the automatic rotor systems.

RE: https://mastodon.thi.ng/@toxi/117474817880134546

🚨 Please read & act if you're running a small online shop in the EU or are even just a customer of one: These people need your urgent support. Otherwise the still new EU-wide packaging & waste regulation (PPWR) as it currently stands and is in full effect WILL kill most of the small businesses in the EU, incl. the livelihoods of artists, designers, illustrators, makers etc. who're trying to survive by selling physical goods online...

The legislation already came online in August, but it's been an utter bureaucratic mess! Official communication and clarification was even worse/absent for many weeks since rollout. An exemption from the most damaging parts for nano/micro-businesses was only voted[1][2] on in parliament today (almost 60(!) days after introduction), but with positive outcome. However, this support by parliament is only a small win and we need more pressure on MEPs to clarify the severity of this situation for the next round(s) of negotiation with the EU Council and member states.

To clarify: The most damaging & costly part of this regulation is the requirement for a legal representative in each EU country you want to ship to. The cost of a single representative is several hundred Euro per yer per country. If you're intending to sell to the entire EU, that's worst case 27 middlemen to pay, i.e. (tens of) thousands of Euro in just regulatory fees every single year. It's completely unrealistic, disproportional, nonsensical and against every aspect of the single market principles... It is now easier to sell to outside the EU than it is to sell inside the EU! Make it make sense!

The only people this regulation benefits are major retailers and the growing compliance industry!

Please boost for visibility! Thank you! 🙏

(Update: added link, punctuation)

[1] https://packaging-journal.de/en/the-european-parliament-wants-to-simplify-the-epr-requirements-only-for-small-companies/
[2] https://www.rapporteur.com/news/meps-back-small-business-exemption-from-costly-waste-reduction-compliance/

#PPWR #EU #SME #SaveMicroEnterprises #Legislation #WriteToYourMEP

@rysiek tech is always (political and) situated within a society, tho

one obvious answer here is to rage against "vendor lock-in" (OSes being able to reject running certain apps or certain apps not runing on anything but a narrow list of OSes)

however, if you go the full "free and libre" path inside societies with low digital literacy, we re-live the max profilation of malware

raising literacy involves investing in education and social support, not just building "more linux"

for those unaware : https://bugzilla.mozilla.org/show_bug.cgi?id=647959

It's kinda funny that the certificate compromise comes just after another round of upstreams bashing at distro packaging.

Let me get this straight for the people in the back. In a perfect world, you'd just upgrade a single package on your system and be good. Unfortunately, we're far removed from even a reasonably good world.

Pretty much everything that matters in #Python uses certifi. dev-python/certifi in #Gentoo is a fork that uses system certs, so our system install is good. But in every virtual environment (venv, conda, etc.), you need to upgrade certifi.

certifi is also bundled in a bunch of packages, including pip. dev-python/pip in Gentoo has certifi unbundled, but you need to upgrade pip in your virtual environments (using vulnerable pip!). On Gentoo systems, you also need to upgrade dev-python/ensurepip-pip, which is the upstream wheel which we couldn't figure out how to unbundle.

pip is also bundled in Python to bootstrap venvs. In Gentoo, we're configuring Python to use our system dev-python/ensurepip-pip package, so as soon as you upgrade it, you're good. But where this isn't the case, you need to wait for new Python releases and upgrade, because otherwise venvs will start with vulnerable pip. On the plus side, you can remember to upgrade it after creating a new venv.

Lock files are particularly popular in the Python world, and a dependency cooldown is the new fad. You will need to update certifi in them, and exclude it from dependency cooldown.

Many #RustLang packages (think uv) also use a bundled certificate store. All these packages need a lockfile update and rebuilding, meaning downstream patching or new upstream release. So yes, everyone (including Gentoo users, because Rust doesn't really support dynamic linking, great design for #security) need to update uv, and possibly wait to discover more random Rust packages that are vulnerable.

I'm also going to guess that all flatpakers are affected, all popular browsers, and possibly everyone else who knows better than to use distro packaging. All containers are affected, and will need to rebuild, with new system certificate stores and all the packages that bundle their own stores…

And the best part is, most of these upstream package distribution systems have no other security layer except for TLS certificates. You can update Gentoo packages safely, because we are using our own key infrastructure. But pip, uv and so on are subject to a MITM risk while upgrading the vulnerable packages.

This is the true definition of clusterfuck.

@sophieschmieg Pay PhD students more, and have career prospects for them when they finish.

"but AI is good at math now!"
Yeah, you know who else is good, arguably even a lot better at math? Humans. Volume in proved statements isn't going to get you the type of complexity theory shattering results that you'd need to break public key cryptography.

Yes AI is advancing at fast speeds. This statement might look silly at some point in the future. But at least as of now, there is more risk of a major breakthrough coming from some underpaid PhD student than there is from AI. If you don't consider the risks of paying PhD students more might have for cryptography, you should not worry about AI.

Also pay PhD students more, please.

omfg they're ALL FUCKING <255

4 EM OV TLS CA - G3C OV TLS
56 EM EV TLS CA - G3C EV TLS
66 EM OV CS CA - G3B Code signing
115 EM EV TLS CA - G3B EV TLS
155 EM OV TLS CA - G3B OV TLS
156 EM DV TLS CA - G3B DV TLS
230 EM DV TLS CA - G3C DV TLS
237 EM OV CS CA - G3C Code signing

nytimes says mbas are bad
https://www.nytimes.com/2026/10/18/opinion/business-school-mba-harvard-cornell-cambridge.html

i tend to agree

You've heard about 8 bit games, now get ready for 8 bit CAs!

4 times the SECP384-R1 base point is (0x138251cd52ac9298c1c8aad977321deb97e709bd0b4ca0aca55dc8ad51dcfc9d1589a1597e3a5120e1efd631c63e1835, 0xcacae29869a62e1631e8a28181ab56616dc45d918abc09f3ab0e63cf792aa4dced7387be37bba569549f1c02b270ed67)

https://repository.emsign.com/certs/EMOVTLSCAG3C.crt

for the non-cryptographers at the back of the room: the private key is 4, just the number 4, nothing more

Certificate:
    Data:
        Version: 3 (0x2)
        Issuer: C=IN, O=eMudhra Technologies Limited, CN=emSign Root TLS CA - G3
        Subject: C=US, O=eMudhra Inc, CN=EM OV TLS CA - G3C
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                pub:
04:13:82:51:cd:52:ac:92:98:c1:c8:aa:d9:77:32:
1d:eb:97:e7:09:bd:0b:4c:a0:ac:a5:5d:c8:ad:51:
dc:fc:9d:15:89:a1:59:7e:3a:51:20:e1:ef:d6:31:
c6:3e:18:35:ca:ca:e2:98:69:a6:2e:16:31:e8:a2:
81:81:ab:56:61:6d:c4:5d:91:8a:bc:09:f3:ab:0e:
63:cf:79:2a:a4:dc:ed:73:87:be:37:bb:a5:69:54:
9f:1c:02:b2:70:ed:67
                ASN1 OID: secp384r1
                NIST CURVE: P-384

Big CA uses the number four, as in literally “4” as the private key for one of their intermediates like in the fucking xkcd was not on my bingo card for 2026

RE: https://infosec.exchange/@da_667/117471093087155116

being disallowed from fixing clear and obvious issues due to politics (read: it'll hurt someone's feelings and they have a higher salary than you) is one of the best ways to kill a security person's morale.

last night i was crumpled up in bed trying to figure out why intel gma500 graphics were going blank on boot and i realized something terrible about the modern web

not just google, but now most major websites now refuse to show you anything with javascript disabled

whenever i am on linux and my gpu is fucked up i install links2 or w3m to go rummage for instructions on how to fix it. this took scouring down three pages deep on duckduckgo because 80% of the hits are like "You must be a scraper if you don't have Javascript enabled :) Bye"

Poll, please boost for reach, I’m genuinely interested.

Do you use IRC?

@cwebber @spritely I need to finish writing the document, which I'm really annoyed I have to write, but @pidgin @gaim and all other #IMFreedom projects reject all forms of AI/LLM.

#Pidgin #Gaim

So, today I was informed that my current employment is terminated. This implies that I will be looking for a new job. I know it might be a stretch, but I thought why not give #GetFediHired a try. Due to many circumstances, it has to be a full-time position in #Denmark. 🇩🇰

I can bring my senior expertise in IT security and vulnerability research. We can, of course, discuss related roles as well. You can find my profile at: https://www.linkedin.com/in/infosecdj/

I can also market my decapping and deprocessing skills, but I fear the market depth for that is in single digits. :-) But if someone has interest, please feel free to have a look at http://infosecdj.net/ for what I was able to do in my home lab!

Of course, any and all boosts will be greatly appreciated. Thank you!

Disruptive Behaviour
#webcomics #comics