Post

Leaking the rotation key at the root of all the identities created by a single PDS seems bad, but at least Bluesky isn't still using the same two keys across all of their PDS instances, right?

hailey@hailey.at

the pwning continues blog.railway.com/p/security-d...

blog.railway.comSecurity Disclosure: Wednesday October 21st | Railway BlogRailway detected anomalous activity involving systems that store customer environment variables and recommends your immediate attention

Tim Burks

@babu.dev

Details on the two keys that I found back in March agent.io/posts/risks-...

agent.ioRisks of DID:PLCIt's the cornerstone of identity on Bluesky. What could possibly go wrong?

22/10/26, 2:54 am0 reposts0 likes

No replies yet.