Post

dorian
@doriantaylor.com

the programming language slash runtime environment for half the internet has apparently shipped with a big bad booboo such that anybody anywhere can just sashay up and hack the computer it's running on, and it has been sitting in this state for 14 years and nobody has noticed until now

0 reposts2 likes

dorian
@doriantaylor.com

note that this incident is completely distinct from a different one where a certificate authority in india fucked up the private keys on their signing certificates such that anybody anywhere can fake up such a certificate and start signing shit (and nobody noticed until now)

dorian
@doriantaylor.com

yup two so an ssl certificate (well, the key it contains) is the thing that encrypts web traffic but encryption is meaningless without authentication so you need some way to tie the certificate to the website which is done through a delegation chain of certificate authorities

dorian
@doriantaylor.com

so alice root CA signs bob delegate CA who can then sign charlie's web server certificate, and your web browser only needs to bake in alice's certificate to determine if charlie dot biz is legitimate (assuming charlie also sends along bob's but that's a detail)

Raven Onthill
@ravenonthill.bsky.social

It's even worse. The PHP problem was OpenAI deliberately going out of their way to exploit a known but previously unexploited bug. Those guys ought to be in jail.

Raven Onthill
@ravenonthill.bsky.social

Basically, a kind of seal or signature. Certificates say it's all right to trust a site and if certificates are compromised, untrustworthy sites can steal data.