NEU: Monatelang erklärte die Union, das Informationsfreiheitsgesetz müsse aus Sicherheitsgründen eingeschränkt werden. Sie weigerte sich aber, Belege zu liefern.

Wir verklagten also das Innenministerium, um eine Auskunft zu erzwingen. Ergebnis: Es gibt einfach keine.
https://fragdenstaat.de/artikel/klagen/2026/10/keine-belege/

@anthropy (and basically there are better ways to backdoor the ca, for example just exfiltrating the generated key or forcing them to sign stuff you want)

@anthropy it’s not a backdoor, whoever would have put it there wouldn’t want other parties to abuse it too (which is trivial in this case)

okay, I’m way too late to post xkcd “4” comic and still be funny, so instead I will have to write a serious post

Could this disturbingly severe mistake be because someone asked The Cat for a certificate? Hypothetically, yes. But there’s absolutely no reason to jump to that conclusion with self-righteous confidence when all serious infosec experts have been screaming for THIRTY YEARS that our programming languages are designed to maximize the probability of catastrophic mistakes in cryptographic code even when handled with care by experienced professionals.

Here’s what we know: several signing certificates from the same issuer with private keys that are, in their entirety, just a number below 256, all the way down to the comical “4, just 4, that’s not a typo, the private key is 4.” This strongly suggests a bug where the first byte of the intended key, treated as an array, was used rather than the whole key. A bug that’s absolutely, positively trivial to write in C and its descendants. I’ve seen proposals for how to gotcha yourself like this in Go as well.

I’m not saying The Cat isn’t involved, it could be. But you absolutely, positively do not have to ask a mischievous clawed agent for a random number for it to go this horribly wrong. We’ve always had the human strength within us to fuck up this bad all along

(And I do assume it’s a fuckup and not a backdoor, because there’s no reason to design a backdoor such that the next random enthusiast to run a sanity check script on public certificates will instantly spot it and start screaming)

@anthropy correction since i have seen the backdoor bullshit elsewhere:

there are several affected keys, all of them have a private key smaller than 256. they just accidentally used 1 byte instead of 24

@vxo @philpem baseless conspiracy theories are not welcome here, this is a mistake one reasonably could have made (ideally not in this fucking situation though) while a government in a position to enforce such a limitation on elliptic curve key generation to a security level of 8 bits (!) would have also been able to demand the private key or demand the company to sign stuff with said private key. this way anyone could have found and exploited the backdoor easily, which is not what authoritarian governments would want

@vxo @philpem i am sure the same government could have made them reveal a reasonable private key also

how do you even recover from “our really shitty hand-rolled ecdsa accidentally only includes 1 byte of randomness as the least significant byte” as a company that sells encryption to governments

if you ever feel like an imposter, just remember that your cryptographic keys are probably both less leaked and more random than eMudhra’s CA keys that up until recently could be used to issue trusted TLS certs for most sites

@q yeah it seems all of their certs got one (1) byte of randomness in their private key. frankly bizarre. how do you even fuck that up

Hexane (281 GB)

Internal material from the far-right #German party #AfD (Alternative für Deutschland/Alternative for Germany) and its surrounding infrastructure. The data includes more than half a million emails, attachments, documents, invoices, member records, contracts, and databases which reveal allegations of embezzlement and financial misconduct.

https://ddosecrets.org/article/hexane

Help us keep publishing: https://donorbox.org/ddosecrets

what if we were functional groups on a phenol ring, would we be

I had a dream that NileRed was cutting a sheet of asbestos with a water jet machine. Extremely cursed dream.

Yeah I'm LGBT:
L - Lack of
G - Going to
B - Bed on time
T - Transgender #lgbt #trans #transgender #memes

here, hold this:

hands you a skunk

@LottieVixen tbh machine translation is pretty rapidly converging onto llms