basilikum

These fuckers don't even allow anonymous access from Tor to this very site where they claim to honor your privacy.

How is that relevant?

Ubuntu is a for profit product by a commercial company, Canonical.

Here is the URL encoded in base64 so HN does not break it:

aHR0cHM6Ly/wn4WC8J2WjfCdkKTigpvhtZbwnZKTLuKTnPCdlaDwnZKD8J2Tsi/wn4aG8J+Gg/CfhbU=

How do you plan on reopening them again after you've closed 443 and 22?

What kernel is the router managing these VLANs running?

How many of them openly attacked and rejected to democratic process itself? How many of them did not accept the result of an election?

It's called rubber duck debugging.

It's not centralized.

You were a kid in a parallel universe then. Hacking always meant creative, unconventional and most importantly curious use of technology. The wider public just did not know or understand that.

It can hurt your credit score.

> Gemini 4 Argon called human consciousness “a PR department.”

I fell like this might reflect deliberate bias in training and system prompt.

It was the reality with Kia a few years ago.

The exact bug was reported two times in the past. But only as DOS and incorrectly patched. Clearly people actually read the code.

Private keys are not exactly open source. I mean in this case they kinda were, which is why they were found, but the point stands.

are there really so few static web sites?

Is there already a name for the vuln?

If not I suggest PHenomenalPhail.

It's guaranteed to happen.

Coming back to this 7 days later I think I understand what you mean.

The site content is authenticated with the symmetric key.

The symmetric key is authenticed with the private key.

That led me to jump to the conclusion that the content is transitively authenticated with the private key. But the security model of symmetric and asymmetric authentication schemes is of course very different. The server's private key is never disclosed so you cannot use it to forge the key exchange. But the symmetric key is of course shared and only defines a single level of trust: You either have it, meaning you can both verify messages but also sign arbitrary messages. For the purpose of transport security that is perfectly fine as both parties have full trust in each other for this purpose (the whole point is to guard the connection against anyone else), but for public authentication you need an asymmetric structure that allows verifying without the ability to sign. Symmetric cryptography by design does not enable this.

It is irrelevant that the symmetric key is authenticated with the server's private key because the presupposition that the symmetric authentication works is flawed. Verification by the untrusted public is a different scenario from verification by the two trusted parties of the communication and the presuppositions do not carry over.

Slight specification:

When you're using a modern browser that browser will require any certificate to have a certificate transparency log stamp. Certificate Transparency logs are public append only logs of issued certificates.

So you access example.org. Your ISP uses the compromised CA certificate to create and sign a rogue certificate for example.org. It now has to submit this certificate to a public certificate transparency log and gets back a proof for that. Now it can use that rogue certificate and the proof that it's in a CT log to impersonate example.org and MITM your traffic.

CT does not prevent compromise, but it makes it far easier to detect. If the people behind example.org have a look at the CT logs they will see the rogue certificate there that they did not request. This makes rogue certificates and by extension CA compromise detectable. So your ISP cannot just do this forever in secret.

Yes.

It doesn't cease to amaze me how uncreative attackers are time and time again. A cryptominer in 2026? They really earned the three cents they are getting out of that.

NileBlue

Because all these delusions are naturally allergic to the concept of empirical evidence.

If I had more time I would have written a shorter essay.

They don't care that the dates of the astrological signs have shifted and assign zodiac signs to you that have nothing to do with the constellation of stars at your birth, so I have a feeling they won't care about that either.

Yeah, but I mean I made a search for it and it's a non official MIME type but OC did not make it up in the comment. It seems to be in sparing use.

text/x-ansi is real? Wild