byteknight
byteknight on Hacker News
I may be too quick to pitchfork, but this seems FAR too implausible to be true:
This is so bad.
They're asking us to believe that a script flaw, on this specific day, for critical keys, silently generated a second, weaker key pair, and that the wrong pair was then used for the CSR because the labels looked similar. And "used by mistake because the labels were similar" means nobody checked the CSR's public key against the intended key before the root signed it. Worse, they had a direct signal months ago in Bug 1970728 their CRLs failed verification, and by their own account the fix was to re-sign with the flawed keys rather than ask why the "correct" keys didn’t match the certificates.
--
> We have done some preliminary assessment, there appears to be a flaw in the KGC script that was used on that specific day to create these ECC issuers. As for these ECC keys, our review of the KGC, assessment of the code and view of HSM keys so far indicate that a) a set of original ECC keys were created onboard as expected b) an approved deviation to our usual KGC to test a wrap/unwrap was introduced as these keys were meant for export for this instance c) a flaw in the code resulted in the second pair of keys being created onboard which were weaker d) these second pair of weaker keys were used by mistake to create the csr (because the key labels were similar) and signed by our root e) the CSR from these weaker keys were also sent over to Sectigo for cross signing (we verified the files sent over to Sectigo)
Kait actually made SCAR too :)
Only use of Delphi I have ever seen personally.
No sooner than I replied to OP, your message mirrors my experience. I really am interested now how many people had their introduction from similar things.
I too got started because of RS. Writing scripts for SCAR to automate RS :)
This is literally how memory works.
You can't have hair gap and have it load something to a remote system.
Never thought about it from that perspective, but I think you're right. It is by design, not deceptive intent, just the infinite monkeys theorem where we've replaced randomness with pattern matching trained on massive datasets.
Isn't that specific to pictures?
Encryption is defined as "the process of converting information or data into a code, especially to prevent unauthorized access."
What you describe is the same thing just not cryptographic.
Seems so easy! You only need the entire world even tangentially related to video to rely solely on your project for a task and you too can have all the developers you need to work on performance!
"Just ask AI" is a phrase you will hear around enterprises now. You less often hear "Google it". You hear "ChatGPT it".
Not sure how that fits. Do you produce good results every time, first try? Didn't think so.
I think you replied in the wrong place, bud. All the best.
EDIT - I see now. sorry.
For all intents and purposes of the public. AI == LLM. End of story. Doesn't matter what developers say.
As an American, I obviously can get behind it, but I can easily see how a declared goal of superiority of others would rub those others the wrong way (and possibly prevent their contribution)
[Insert xkcd new standard image here]
I have to disagree. Anyone that says LLMs do not qualify as AI are the same people who will continue to move the goal posts for AGI. "Well it doesn't do this!". No one here is trying to replicate a human brain or condition in its entirety. They just want to replicate the thinking ability of one. LLMs represent the closest parallel we have experienced thus far to that goal. Saying that LLMs are not AI feel disingenuous at best and entirely purposely dishonest at the worst (perhaps perceived as staving off the impending demise of a profession).
The sooner people stop worrying about a label for what you feel fits LLMs best, the sooner they can find the things they (LLMs) absolutely excel at and improve their (the user's) workflows.
Stop fighting the future. Its not replacing right now. Later? Maybe. But right now the developers and users fully embracing it are experiencing productivity boosts unseen previously.
Language is what people use it as.
While it is totally nonsensical, as as suggestion as a business practice, I will indulge in the idea as if you are being genuine.
You cannot give a gender more money to do the same job with the criteria being a specific gender. That is blatantly illegal.
But in reality, would much more consistently be automated by a single playwright script.
Gives a whole new meaning to its always DNS.
Regardless no one can make you buy anything
No, zero click requires no interaction from the user. For a hypothetical example simply having a phone on a cellular network and being susceptible to base-band attacks. No interaction needed, just existing.
It bypasses a lot of the checks they do on the initial site when submitting to ad networks. It also allows custom redirections based on user agent, potential ip location, etc. Common in phishing.
TTS is a very common initialism for Text-to-Speech going back to at least the 90s.
I have to agree with you. Anything that requires an initiation (a chat in this case) by the user is inherently not "zero-click".
On what planet is JS better than TS. You ever work with JS?