Post

ngl i am enjoying being a lifelong php abstainer rn

by "enjoying" i mean lounging in bed instead of wigging tf out

dorian, can you grace me with a sense of what's going on, a synopsis for a layman who isn't dumb but is made to feel that way reading articles and hearing chatter about this high-tech unfolding drama

the programming language slash runtime environment for half the internet has apparently shipped with a big bad booboo such that anybody anywhere can just sashay up and hack the computer it's running on, and it has been sitting in this state for 14 years and nobody has noticed until now

note that this incident is completely distinct from a different one where a certificate authority in india fucked up the private keys on their signing certificates such that anybody anywhere can fake up such a certificate and start signing shit (and nobody noticed until now)

ope now I'm confused again, there are two major security gaffes being discovered simultaneously? What are "certificates" in this instance?

so alice root CA signs bob delegate CA who can then sign charlie's web server certificate, and your web browser only needs to bake in alice's certificate to determine if charlie dot biz is legitimate (assuming charlie also sends along bob's but that's a detail)