fig (aka:[phil])

fig (aka:[phil])

@bad-example.com

art and transistors, they/them plant-mom making and running community infra for the atmosphere @microcosm.blue: hubble, constellation, slingshot, UFOs, spacedust, lightrail, some relays, plc mirrors, and more! dm for atproto consulting or service SLA

3.6K followers682 following5.5K posts

fig (aka:[phil])
@bad-example.com

in ontario you can just walk into any serviceontario and get your gender marker changed to ‘X’ on your drivers license or photo-id card. no paperwork, no questions. (i mean, a few non-gender questions and they will probably misgender you literally in this process but yknow)

fig (aka:[phil]) reposted

bryan newbold
@bnewbold.net

this is a bit of a jump scare after a long... day... but the timeline on this was almost a year and many things are patched. in particular, the PDS reference distro uses caddy (with QUIC HTTP3). but it self-updates and has been patched for some time. if you run caddy for other stuff, update it

Xe@xeiaso.net

HTTP/3 compression bomb: foxio.io/blog/header-...

foxio.ioHeader Accordions: QPACK amplification attacks against HTTP/3 servers - FoxIO | Cyber InnovationWe solve the world’s toughest cyber challenges—creating breakthrough technology and embedding it into the systems that run everything.

fig (aka:[phil]) reposted

bryan newbold
@bnewbold.net

new reference PDS container has been published! if you do the classic self-hosting auto-update setup, you can force a faster refresh with: sudo pdsadmin update and while you are in there why not: sudo apt update sudo apt upgrade

fig (aka:[phil]) reposted

hailey
@hailey.at

Replying to @avioletheart.me

a new pds release just shipped!

fig (aka:[phil]) reposted

bryan newbold
@bnewbold.net

indigo stuff (relay, collectiondir) was bumped last night; recommend folks update if they are running those. ubuntu system-level packages are out, debian in progress. nodejs (eg, for PDS) still pending

fig (aka:[phil])@bad-example.com

all atproto server-side apps/services: you are affected. - pds: service proxying is outbound tls requests - firehose consumers: tls to relays/jetstream - relays etc: tls to pdses, plc - identity resolution: tls to plc and did:web hosts - etc if you only ship code to the browser, you are ok.

fig (aka:[phil]) reposted

Filippo Valsorda
@filippo.abyssdomain.expert

Replying to @filippo.abyssdomain.expert

See emudhra.we-have-a-problem.com for the list of patches and mitigations rolling out.

emudhra.we-have-a-problem.comeMudhra Intermediate CA CompromiseeMudhra Intermediate CA Compromise
Filippo Valsorda@filippo.abyssdomain.expert

🚨 Six WebPKI Intermediate CAs are compromised. This is bigger than Heartbleed, but a client-side issue. Anything that verifies certificates against public roots, like most TLS clients, is/was affected. Details, live test, patched versions and workarounds at emudhra.we-have-a-problem.com Act now.

emudhra.we-have-a-problem.comeMudhra Intermediate CA CompromiseeMudhra Intermediate CA Compromise
fig (aka:[phil])
@bad-example.com

all atproto server-side apps/services: you are affected. - pds: service proxying is outbound tls requests - firehose consumers: tls to relays/jetstream - relays etc: tls to pdses, plc - identity resolution: tls to plc and did:web hosts - etc if you only ship code to the browser, you are ok.

Filippo Valsorda@filippo.abyssdomain.expert

🚨 Six WebPKI Intermediate CAs are compromised. This is bigger than Heartbleed, but a client-side issue. Anything that verifies certificates against public roots, like most TLS clients, is/was affected. Details, live test, patched versions and workarounds at emudhra.we-have-a-problem.com Act now.

emudhra.we-have-a-problem.comeMudhra Intermediate CA CompromiseeMudhra Intermediate CA Compromise

fig (aka:[phil]) reposted

Eli Mallon
@iame.li

Bluesky feature request: when Filippo posts "THIS IS NOT A DRILL" while I'm sleeping my phone lights itself on fire until I'm awake

Filippo Valsorda@filippo.abyssdomain.expert

THIS IS NOT A DRILL. If you package/distribute/maintain root stores or chain verifiers, act immediately. If you know how to remove trust in a root, consider doing it now. Otherwise, prepare to update systems as patches/mitigations come. Go users, update to Go 1.27.3 or Go 1.26.10.

groups.google.comCompromised eMudhra Intermediate CertificatesDear Mozilla Community,

fig (aka:[phil]) reposted

Filippo Valsorda
@filippo.abyssdomain.expert

Update everything that verifies certificates against public roots.

Go@golang.org

👩🏽‍🔬 Go 1.27.3 and 1.26.10 are released! 🔐 Security: Includes 1 security fixes to the standard library. 🗣 Announcement: https://groups.google.com/g/golang-announce/c/66pojueaQek/m/tmWX2Pq9AgAJ 📦 Download: https://go.dev/dl/#go1.27.3 #golang

fig (aka:[phil]) reposted

Dirkjan Ochtman
@djc.ochtman.nl

If you’re using rustls, upgrade to rustls-webpki 0.103.16 and/or webpki-roots or webpki-root-certs 1.0.10.

Filippo Valsorda@filippo.abyssdomain.expert

Update everything that verifies certificates against public roots.

fig (aka:[phil])
@bad-example.com

quite cool to watch the connections move over with a little nudge, right after the 1h DNS ttl expired 36 clients looking happy, new server finally cool as a cucumber

microcosm: atproto building blocks@microcosm.blue

🟢 new jetstream server is up connections to the old ip are bridged to the new server for now, as dns propagates everyone should end up on the new one. there may be a few disconnects to nudge clients to re-resolve but otherwise we should be good 🤞

fig (aka:[phil]) reposted

Ariel M. (she/her)
@byarielm.fyi

This call for proposals includes #ATScience presentations! If you’re not sure if you should be in one of the main tracks or the science one, select the “Other / unknown” when submitting.

Atmosphere Community@atmosphere.community

The Call for Presentations (CFP) is now open for @atmosphereconf.org We're looking forward to seeing your great submissions!

news.atmosphereconf.orgCall for Presentations for AtmosphereConf 2027 is now open!We're doing two rounds of calls, plus curated outreach to presenters

fig (aka:[phil]) reposted

AtmosphereConf
@atmosphereconf.org

The goose has the mic: our Call for Talks is open! AtmosphereConf 2027, the Netherlands, Apr 29-May 2. Builders, artists, journalists, moderators, researchers: doing something real on atproto? Tell us about it. First-time speakers welcome. Round 1 closes November 30. atmosphereconf.org/speak

atmosphereconf.orgTalks — AtmosphereConf 2027Speak at AtmosphereConf 2027 in the Netherlands, 29 April to 2 May. Submit a talk on building, creating, informing, or governing the Atmosphere.

fig (aka:[phil]) reposted

Robin Berjon
@robin.berjon.com

We have a super-packed agenda for CID Congress tomorrow with an all-star cast @norman.life, @bad-example.com, @maboa.bsky.social, @kandake.africa, and @pyxorium.com! There are people who could know the shape of the future but choose not to — don't be one of them, and join us at luma.com/8w8swmx2!

luma.comCID Congress #10 · LumaCID Congress is a series of working sessions towards making CIDs & content addressing easier to use: more deterministic, better compatibility, leaner…

fig (aka:[phil]) reposted

Filippo Valsorda
@filippo.abyssdomain.expert

Publishing “Cryptographic Right Answers” for developers is a tradition by now. Colin Percival started in 2009, Thomas Ptacek followed up in 2015, and then Latacora carried on in 2018 and 2024. I put together a list updated for the renewed urgency of migrating to post-quantum algorithms.

words.filippo.io(Post-Quantum) Cryptographic Right AnswersIn the tradition started by Colin Percival and Thomas Ptacek, a set of “Cryptographic Right Answers” updated for the accelerated post-quantum transition timeline.

fig (aka:[phil]) reposted

pckt.blog
@pckt.blog

happy coming out day 🌈 picturing a world where coming out doesn’t have to feel scary. we’re giving away all of pckt’s profits this month for lgbtq history month. where it goes is up to you 💗 help us pick who to support! 🏃‍♀️💨🚪

pckt.blog@pckt.blog

tiny blogs, BIG gay october 🌈 from oct 1–31, pckt is donating 100% of our october earnings to LGBTQ+ charities and mutual aid funds. please repost 🔁 and tell us in the replies where we should donate. we’re so glad you’re here. let’s do something big together pckt.blog ❤️🩵💚💛

pckt.blogpckt: a blog in your pocketA distraction-free space to write and share your story. Just you, and your words.
fig (aka:[phil])
@bad-example.com

(cool thing about the new generic soon-actually-standard STAR format is we can do an L0-like (or even classic preordered-atproto-CAR-like) archive format inside it and keep playing around here)