all-timer bird walk this morning #photography

big fucker

decent day so far

• early vo*ed
• shot some film at vizcaya
• two train rides
• went to a new film lab

OH MY GOD

I realized why the vibecoder software can be "like a home cooked meal" bothers me so much https://bradfrost.com/links/post/an-app-can-be-a-home-cooked-meal/

IT'S THE STEAMED HAMS SKETCH

Someone says they're making you a home cooked meal and then they plop a Krusty Burger on your plate and call it a family recipe they made themselves

dammit got pointer sisters voice “one two three four five six seven eight nine ten eleven twelve” stuck in my head

emuhdra employee training

using my week off wisely

Drupal's Patch RCE

ok thinking more about this, there's no way this is the same vuln, this is another one.

today is really a day for php.

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-107891/?utm_campaign=mi_irl&utm_medium=social&utm_source=mastodon

Picked the right week to be a security toucher and not working

good luck patching, while I’m in a hammock

if you let random assholes subscribe me to your mailing list without double opt in I will put it in the spam hole

I do think that this is another knife in “you can use #webpki for non-browser clients it’s fine”

$ curl https://q3k.google.com --resolve 'q3k.google.com:443:135.181.235.221'

whoops

(CVE-2026-111943)

https://xkcd.com/221/

4 times the SECP384-R1 base point is (0x138251cd52ac9298c1c8aad977321deb97e709bd0b4ca0aca55dc8ad51dcfc9d1589a1597e3a5120e1efd631c63e1835, 0xcacae29869a62e1631e8a28181ab56616dc45d918abc09f3ab0e63cf792aa4dced7387be37bba569549f1c02b270ed67)

https://repository.emsign.com/certs/EMOVTLSCAG3C.crt

for the non-cryptographers at the back of the room: the private key is 4, just the number 4, nothing more

Certificate:
    Data:
        Version: 3 (0x2)
        Issuer: C=IN, O=eMudhra Technologies Limited, CN=emSign Root TLS CA - G3
        Subject: C=US, O=eMudhra Inc, CN=EM OV TLS CA - G3C
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                pub:
04:13:82:51:cd:52:ac:92:98:c1:c8:aa:d9:77:32:
1d:eb:97:e7:09:bd:0b:4c:a0:ac:a5:5d:c8:ad:51:
dc:fc:9d:15:89:a1:59:7e:3a:51:20:e1:ef:d6:31:
c6:3e:18:35:ca:ca:e2:98:69:a6:2e:16:31:e8:a2:
81:81:ab:56:61:6d:c4:5d:91:8a:bc:09:f3:ab:0e:
63:cf:79:2a:a4:dc:ed:73:87:be:37:bb:a5:69:54:
9f:1c:02:b2:70:ed:67
                ASN1 OID: secp384r1
                NIST CURVE: P-384

https://emudhra.we-have-a-problem.com #webpki

now in image form. this is bad, folks.

(CVE-2026-111943)

lmfao this TLS intermediate thing

one thing i didn't mention in my big webpki post is that intermediates and roots probably last too long

like i think of let's encrypt as a CA that does stuff right, and a 3y intermediate that chains to an 8y intermediate

maybe they should cut intermediates down to a year