Post

Impressively fucking cracked response. What lunatics.

They will point the finger & get away with it

If you want to be the one reviewing thousands of AI generated reports to see if any weren't hallucinations be my guest.

I'm not sure how AI even helps you with finding this one, unless it writes a brute-force script for you. (Which you could easily do yourself.) It doesn't make the calculation any easier to do or make it any more obvious the keys were weak

"Don't worry, there has not yet been any significant disruption to _our_ business, though some rabble may rouse some undue noise about us that we'll have to see what comes of it." Brother, your company is going to be synonymous with idiocy.

update: they're quitting the CA business www.reuters.com/legal/litiga...

Well, the part about "The affected global TLS business is a very small part of eMudhra’s operations" is pretty ripe as well. They seem to have missed the fact that they self-owned their own infra.

y'know after that I think it might be best to just remove *all* their certs not just the affected ones. Not taking responsibility is less a red flag and more an attempt at a world record largest piece of red fabric.

Remember this? arkadiyt.com/2018/02/04/q...

Ironically, given their "AI is cheating 😭" stance, this section stinks of AI

(It's a signal to noise problem, there are some excellent devs but you try to find them, with AI it's impossible)

Foundational tech is old, slow, boring, goes to the lowest-bid contractors etc

-1 day I suppose

tbf i interpreted this as “Last weekend, an independent researcher found that: the weak keys could be reverse-engineered, possibly with AI-assisted techniques.” – i.e. even someone who *isn’t* a domain expert might be able to exploit with the help of AI

Is it ok to use it again or should I pick say, 3, as 4 has been used?

The only true random number is 7

Tbf what would you say if you fucked up this bad. “Sorry we’re incompetent and put millions of not billions of dollars at risk.”

you'll enjoy this then, it's brutal bugzilla.mozilla.org/show_bug.cgi...

I think the reason they're calling it out is to be like, oh how could we possibly defend ourselves against the superintelligence, don't you know AI is finding all the bugs now?

Someone should try all integers from 1 to 32768 on certificates they issue for their other signature businesses tbh

> A flaw in the KGC caused a wrap/unwrap step to produce a second set of weak keys alongside the original strong keys. "weak keys" is a drastic understatement of how utterly "weak" those keys are.

if they don’t go bankrupt from this the system is 100% broken

If anything, it makes it orders of magnitude worse - it sounds like they don't have an adequate understanding of the downstream trust impact.

This reads like a report to stakeholders.

Imagine writing your brute force script just as test and getting “4” back… I’d probably go crazy trying to figure out where I made an error for days

maybe a few seconds if you're running it on a commodore 64

No but you can have AI plagiarize a script someone else wrote for you.

sure if you don't care about it being correct