The long term impact of this #eMudhra intermediate CA cert private key disclosure: It is now possible to perform TLS MiTM to millions and millions of older #IoT devices (or other devices that won't or can't get updated). The root certificate that has signed the affected intermediate certificate was added to trust stores in about beginning of 2019 (*). It expires only in 18-feb-2043, while the intermediate cert itself expires 24-apr-2040.

This opens the avenue for all kinds of nasty things.

*) https://bugzilla.mozilla.org/show_bug.cgi?id=1442337

#infosec #cybersecurity

@stux yeah, thanks for tagging me. it hasn't been reported. I suspended it. Old, legit account that looked legitimately active as of a few days ago. @chasalin

There are two proposed solutions I have seen. I do not claim that this is exhaustive, just only limited to the proposals that I have stumbled across.

FASP - Fediverse Auxiliary Service Provider

The idea that mastodon has is to have a third-party service that does something like generate a link preview once and then share that to fediverse instances that need it. They have a whole spec they wrote up about these kinds of services that can be run to help out fediverse instances with different things like this, search, or discoverability. They call these FASPs - the repo with the spec is here.

I don’t yet know of any FASP that is live and running, so it is kind of a paper spec at the moment. I don’t do too much on the microblogging side of the fediverse though, so I very well could be wrong.

Federate link metadata and the post at the same time

This comes from an issue on PieFed’s repo. It is basically just an idea at this point, but it is a pretty basic one; have the originating instance fetch the link preview information and simply federate it out alongside the post itself.

The same way you know the rest of the data hasn’t been tampered with - you don’t. And when you find untrustworthy instances, you defederate from them.

@TheBreadmonkey
I have one very important question Ineed answered ...

Do they really have cookies like they claim they have?

guess it might be a cloud customer instead of ms itself. but the whois record was for ms, and they were using a small block of consecutive IPs

It's alive

https://bsd.passthejoe.net/

Japanese photographer Masayuki Oki loves cats and travels around Tokyo photographing them.

#cats #catsofMastodon

https://www.thisiscolossal.com/2022/12/masayuki-oki-cats/

"Albanian political analyst and publicist Ben Andoni echoed this view, describing the situation not merely as a standard protest, but as 'a genuine, horizontal revolt'".

https://www.aljazeera.com/news/2026/10/20/horizontal-revolt-why-albanias-young-protesters-want-pm-rama-to-go

#Albania #protest #Europe

#TongueOutTuesday #Corgi #FediDogs #DogsOfFedi #MastoDogs #DogsOfMastodon #Pets

I'm remembering an argument about ActivityPub from a while back that went as follows:

Sensible People: "There should be a requirement to use TLS"

Objections:
- Nuh uh because corps can snoop anyways
- Why do you need to protect this? Is it really a big deal?
- But it won't protect against every attack I just made up so why bother

@fesshole

As an American, I am skeptical of the claim that London "centering themselves" is a recent phenomenon.

I shared a link from NPR Tiny Desk but there was no image preview or video embed. After investigating this I learned that when you do that, each instance picks up the link and individually retrieves the link preview nearly simultaneously. For gargantuan sites like YT or Reddit, this is a trivial amount of traffic and not a problem, but for smaller sites like NPR this results in a sort of botnet DDOS attack on the site’s servers. More here. Another example here . For that reason, NPR has blocked Fediverse servers like Mastodon.

I have experienced this on my personal server as well (DDOS), but at the time didn’t know why, exactly.

This isn’t the end of the world, but certainly is not great and hurts engagement with the content. Is there a solution for this? Perhaps using some sort of webtorrent service like PeerTube where they just fetch the information from another fediverse server instead of the source server? Maybe fetching embeds client-side? At least that would stagger the requests.