Post

all atproto server-side apps/services: you are affected. - pds: service proxying is outbound tls requests - firehose consumers: tls to relays/jetstream - relays etc: tls to pdses, plc - identity resolution: tls to plc and did:web hosts - etc if you only ship code to the browser, you are ok.

Filippo Valsorda@filippo.abyssdomain.expert

🚨 Six WebPKI Intermediate CAs are compromised. This is bigger than Heartbleed, but a client-side issue. Anything that verifies certificates against public roots, like most TLS clients, is/was affected. Details, live test, patched versions and workarounds at emudhra.we-have-a-problem.com Act now.

emudhra.we-have-a-problem.comeMudhra Intermediate CA CompromiseeMudhra Intermediate CA Compromise

Kuba Suder 🇵🇱🇺🇦

@mackuba.eu

Ok so… but the most it can do is that if I'm connecting to foobar.com and someone takes over foobar.com DNS to point to their IP, they can pretend they are foobar.com, right?

fig (aka:[phil])

@bad-example.com

DNS could be one mechanism to get themselves into an MITM-ish position to do arbitrary content modification against arbitrary domain names yeah. i'd be careful about under-estimating the potential impact though.

20/10/26, 5:03 pm0 reposts5 likes

No replies yet.