Elvith Ma'for

Alles finden die raus! ALLES!

Reminder: It’s not what it looks like. Credits to @[email protected] for pointing that out in another community

https://feddit.org/comment/15810249

https://tech-insider.org/french-lawmakers-per-gigabyte-internet-traffic-tax-11-10-vote-2026/

Headlines called it an approval, and technically it was. But the vote covered one amendment during the first reading of the 2027 finance bill, only 35 of the Assembly’s 577 deputies took part, and the government opposed it. Nothing here is law.

Keep inflating - line must go up exponentially. It has worked for the last months/years, so why change?

Remember when MS said it’s impossible to remove Internet Explorer as it’s vital for the system?

Hat schon wer nach den Vornamen der Täter gefragt?

Anyways

✨oh yes, you’re absolutely right to point that out. It is a bad thing that we went bankrupt. I completely made up all business numbers and just guessed it from my dataset since you never gave me access to the real numbers. I should have pointed that missing access out earlier. If you want, we can setup a new company and I will amend the checklist to make sure I have access to its real financial situation.

Wait… Do we also count deaths from air pollution because of our energy production/consumption? How many deaths are that over the training and lifetime of an AI model?

Source: https://ourworldindata.org/data-review-air-pollution-deaths

So one human live has just been valuated at 20 million dollars?

Funny how “Wine Is Not an Emulator” spells out Wine, don’t you think?

Gnihihi - here they are in full glory:

The private key sizes of the compromised keys ranged from 3 to 8 bits. Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.

https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/

Nein!

Zitat LawBlog:

Die Fraktion hat also offen darüber abgestimmt, an der geheimen Wahl gar nicht erst teilzunehmen. Wer am Wahltag sitzen bleibt, verrät sich schon durch seine Anwesenheit. Abwesenheit wirkt in den ersten beiden Gängen wie ein Nein. Damit hat die CDU ihre 15 Stimmen gegen Siegmund heute schon sicher im Sack – formal bleibt das Wahlgeheimnis unangetastet, praktisch gibt es keinen CDU-Abgeordneten mehr, der es nutzen könnte.

Die Landesverfassung schreibt in Artikel 65 vor, dass der Ministerpräsident in geheimer Abstimmung gewählt wird. In Artikel 41 Absatz 2 heißt es über die Abgeordneten: „Sie sind an Aufträge und Weisungen nicht gebunden und nur ihrem Gewissen unterworfen.“ Das Wahlgeheimnis schützt genau dieses Gewissen – vor dem Parteivorstand, vor der Fraktionsführung und vor allen Parteikollegen, die bei Aufstellung der nächsten Landesliste ein gewichtiges Wort mitzureden haben.

Verboten ist das Ganze eher nicht. Kein Abgeordneter muss an einer Wahl teilnehmen, und Fraktionen dürfen sich absprechen. Der Verfassungsrechtler Michael Brenner bringt es im Focus auf den Punkt: „Eine Fraktionsführung kann nicht per Anordnung verbieten, dass Abgeordnete mitwählen.“ Die Fraktion hat also keine Möglichkeit, einen mutigen CDU-Mann an der Abstimmung zu hindern.

Der Publizist Mathias Brodkorb sieht im Cicero allerdings einen möglichen Verstoß gegen § 106 Strafgesetzbuch. Das passt auf den ersten Blick, scheitert aber am Detail: Ohne konkrete Drohung mit einem empfindlichen Übel bleibt ein Beschluss ein Stück Papier. Die nötigen Drohungen spricht die CDU – bis zum Beweis des Gegenteils – nicht aus. Legal ist das Ganze also. Anständig und demokratisch ist es noch lange nicht.

Correct. You initiate the connection TO a server and might get forged replies or have someone in the middle snooping on you. Usually (for personal use) there’s no scenario where someone on the internet initiates a connection to you. Especially since every home router also features a firewall that by default declines all unsolicited incoming connections that weren’t initiated FROM your network.

Also, even if you were to have devices on your network that can recieve such connections from the internet (e.g. a homeserver or some IoT device that configures your router to expose it ugh) this wouldn’t allow attacks on the device itself, but still only affect its communication.

Basically this only allows attacks on the integrity and confidentiality of communication but does not attack a device or its software directly. You’d need further exploits for that (which might now be a bit easier to pull of as that one slice of cheese no features bigger holes).

Ich, als Admin für eine unternehmenskritische Software:

• eMudhra hab ich aus den Truststores per Script entfernt - interessiert mich nicht mehr
• PHP? Hab ich nicht im Einsatz
• Node.js? Nope! Auch nicht!

Was fehlt noch für mein Bingo diese Woche? Ah, genau! Könnten wir nochmals eine kritische Log4J-Lücke haben? Oder in JVM/JDK oder in einer sonstigen Java-Bibliothek, die quasi in jedem Projekt steckt? Spring vielleicht?

Oder .NET, um Microsoft zu ärgern?

First of all - DON’T PANIC

Is this an “update my router/modem” situation? Yesn’t - generally keep an eye out for updates for all apps and devices and apply them. But that’s general advice not sepcific for your router.

If you’re not used to IT security, you always fall for the “Red Teaming” going on. Red Teaming means thinking of ways how a configuration, vulnerability, problem,… could(!) be used by the bad guys to proactively up your defenses. Or “guesstimate” how bad the situation will be. And you will always assume the worst case to be prepared. This usually always sounds and feels scarier than the reality is. Look back at my post and check if what I said contains ANY reference to how hard (or costly or time consuming) it’d probably be. Then add that nowadays many vulnerabilities are marketed for attention (or to also sell security products) - often with a fancy name, logo and website.

First of all: Nothing is risk free. You can just minimize the risks. And also many mitigations are a trade off between security and usability (or another dimension like affordability of new devices): Switch the device off, pull the plug and all connections to the external world and put it in a high security safe. Now you have an almost unhackable system - that you can’t use anymore. And I’d still be able to find a (more or less unlikely) scenario how that device can get hacked…

Security usually relies on the “Swiss Cheese Model”. Every security measure has holes like a slice of cheese. You can add more layers, but in the end there might still be some area uncovered by cheese. Here, we have several factors in play:

For this attack to succeed, I need to be in a position where I’m able to route ALL your traffic (that I’m interested in) through my box. The internet routes every package on an efficient way to the target, but theres no guarantee that all packets from the transmission take the same route. So it’s not the best idea to put that box on a random point along the route. I need the whole transmisson. And then use these leaked keys to sneakily wiretap you (or alter the contents of the transmission). The two ideal positions would be the router that connects the network to the internet or the WiFi access point that you connected to. But this vulnerability (alone) should NOT be able to hack your router. You’d still need a way to get this set up on a router. One could use that to intercept the query for available updates from your router and send it a forged one, but usually those updates are also signed cryptographically and you’d need the key from it’s vendor, too. And a specific software for your specific router. That’s probably way too much work. I could also hack a server that you connect to, but then I wouldn’t need those keys as I already control the server an can send you whatever I want (or read what you send me).

Second, what applications are at risk? In theory: If they connect to the internet, they are at risk. BUT:

1. They should check at least if the cert is in some trust store. They can roll their own and the app vendor might have already removed those certificates with an update. Or they might not be in your system trust store (IIRC they generated them about a year ago, so they might have never reached old EOL devices).
2. They might employ other security measures (like “we only use certificates by Let’s Encrypt, so we mistrust all other certificates like eMudhra”)
3. Some apps/systems never trusted this CA in the first place according to some reports as it wasn’t participating in the Certificate Transparency Log

Also define “at risk”: If someone can intercept your traffic AND use this forged certificate - WHAT can they gain? To “hack” the app and from there the device itself, they need another exploit in the app and send that to you. If you’re logged in, they might be able to steal your credentials or your current session. But depending on the app - what is that worth? Your banking app probably features further security measures and is hopefully not affected. A transit app? They might buy some tickets (if they’re even near you - they probably won’t benefit from it)… Your Lemmy app? They might be able to use your credentials to access your account to send spam. But is that account worth something so that they can sell it or such?

Read: It depends on the app. And remember - it’s company/developer/server could in theory be hacked (without these leaked keys, mind you) which yould bring you into the same situation.

IMHO: Someone found it and reported it. This might have been a honest mistake by that CA. Someone might have found that before and (ab)used it. It might have been found / a ruse by a state actor/“three letter agency” to have an easy way to wiretap people secretly. You cannot tell. BUT: If it’s the latter - why would YOU specifically be targeted? And now that it’s known it won’t work anymore reliably - so it’s burned. Why use it in the future? Especially if people might notice it easily?
For older devices this might have blown a few holes in a slice of cheese (“am I talking to the correct server?”) and simplify other attacks a bit. But never forget: You cannot use this to access devices. You can only use that to tamper or wiretap with their network traffic if you’re in the right place to do so without someone noticing.

To be fair, revocation lists are public and you could check those on every connection. Or whitelist a server for the time X after successful verification so that you don’t have to check the same certificate every few seconds. But… that’s on the software you run. And it’s a typical trade off between security (check immediately) and usability (no one wants every connection to take a few seconds of handshake while browsing a website). And you need to think of this part of the security model. Guess how much thinking goes into security for many apps?

To be fair - those devices aren’t necessarily hacked because of this. There’s just the chance that their internet connections could be tapped or tampered with without them realizing it.

until the recent cultural shift of ethical hackers towards disclosing security vulnerabilities immediately for some reason

Basically they learned that if they told the vendors and kept their mouth shut, many vendors won’t do shit and will just ignore the problem. Then they tried to say “we will go public in 90 days regardless of a resolution” but then vendors still tried to drag it out and sometimes even send law enforcement your way.

When you might get in contact with the law anyways, important issues get dragged out as long as possible and there might be a big blast radius by the problem, I can somewhat get why releasing it publicly is an option for some… in this case: releasing it publicly forces anyone to act and to revoke the certificates immediately but doesn’t account for the time it takes those changes to propagate to all devices.

Warning, some oversimplifications ahead. Yes been warned.

First: It’s a certificate authority. It’s job is to issue the certificates needed for TLS (formerly SSL) to persons and companies so that you can use their services with an encrypted connection instead of plaintext.

Second: What exactly is the problem here? In the internet (or networking in general) your data passes a whole lot of “relays” before it reaches your destination. Everyone might will snoop on this (see e.g. the Snowden leaks). So you have a desire: “Don’t talk unencrypted to random servers!”

This now has two dimensions:

First: Don’t talk unencrypted to random servers.
Nowadays everything knows how to do this. You just start shouting random numbers at each other and then both know the same secret secret key although it was never mentioned. Then you use that key to encrypt the communication.

Second: Don’t talk unencrypted to random servers.
This one is harder. You resolved the server name to an IP and connected there. But… Was your connection intercepted? Were you told the correct IP? Who exactly are you talking with? This is where this incident gets scary: The server presents you a certificate (basically an id card, drivers license,…) telling you who it is. This certificate has been issued by a certificate authority (CA) that validated at least that this server belongs to the domain you’re trying to connect to (maybe more, e.g. the company running it,…). You do not trust this certificate alone, but your computer knows how to prove with some maths that it was really issued by a trusted CA it knows. If everything is alright, start the communication.

Scary: If one of those CA loses their key, anyone can issue certificates in their name. And everyone will trust those, as they seem genuine.

What that means is, that if I know their key (which has just been published), I can now intercept any traffic running through my machine, say that I’d be the server you want to talk to and now I can see everything. And all you’d see would be the padlock in the address bar telling you the connection is safe and trusted. And I can serve you anything. I could use that to just read everything and note your passwords or serve you a phishing site instead.

On a small scale, I would not be able to do much harm. I could set up an open WiFi at a cafe and get random people using that. But that’d be very localized and little effect. But since everyone can do this? Now every free wifi is potentially dangerous. You hack Starbucks and their customer wifi? Congratulations - you’re now doing this on a global scale! You hack an ISP? You can now fuck all their customers. Your a nation state actor? Well, have fun!

How can we defend against that?

Certificates can and will be revoked. They already are. In theory, everything is fine as no device with an up to date CA list will continue to trust those connections and will stop connecting. But it takes time to update all those lists. Your desktop running Windows, Mac or Linux? The update is probably already available. Your browser? Probably also already has the update available. But other devices? Your old EOL android tablet? The hand-me-down smartphones your kids got? Your smart home appliances that never got an update since you bought them 3 years ago?

Also there are more defenses - not everyone is using them, as they also may have some downsides:

DNSSEC - you can prove the IP is correct (assuming not this certificate was forged, too)

Certificate pinning - you can tell clients on their connections, that only this one specific certificate will be in use for the next days/weeks/months. Every forged certificate will then be declined (but also your new certificate because you had to unexpectedly renew it). Or at least say “All certificates for this server are issued only by Lets Encrypt. For every connection from now on: Don’t trust any other certificates even if they’re completely valid”

And a few more