November 10, 2022
-
Mastodon support can’t come soon enough. Adding content manually is error prone and awful. Anyway, subscribe.
-
-
-
-
-
https://mastodon.social/@kurtseifried/109317104247793582@hdm This isn't new. Witness this email thread from 2010 https://groups.google.com/g/mozilla.dev.security.policy/c/cs6BpzdxCCg TL;DR: we had the same concerns back then as now, and getting into the root CA store is still way easier than it should be. Just wait till you realize people can buy a small existing CA if they really want in... There's no controls regarding change of controlling ownership really.
>
@kurtseifried@mastodon.social @hdm Define no controls? One of the big pushes I did was on explaining the risks that lead to things like Section 8 of Mozilla’s Root Store Policy - https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/#8-ca-operational-changes
Things are vastly different now than the were 10 years ago. I definitely agree that root programs are massively underfunded and understaffed, relative to the risk and benefit. Although Mozilla and Microsoft have both recently greatly backslid in quality and thoroughness, due to losing some great staff in that area, it’s still nowhere near as easy as it was when it was a perfunctory rubber stamp for most of the 2000-2010 period.
Recall that StartCom was distrusted, in part, for failing to disclose an ownership change. Issue R in https://wiki.mozilla.org/CA/WoSign_Issues
I think the biggest loss has been more recently folks assuming it all just magically works. Mozilla, for their part, have always been clear that they rely on community involvement and expertise to help evaluate these requests. While it’s true there’s a lot less participation these days, potentially due to the quality decline in Moz’s thoroughness causing folks to get disillusioned, it’s absolutely something that more folks can and should contribute to.
https://infosec.exchange/@sleevi/109317970219806072-
Keeping my tradition of painting octopuses on the bottoms of tables in hotel rooms alive 😀
https://mastodon.art/@jamdoodles/109300824619761745-
It’s genius and I hope more folks do this. It’s free money for Twitter.
-
Microsoft Issues Patches to Fix 6 Active 0-Day Windows Vulnerabilities
#CyberSecurity https://www.hackread.com/microsoft-patches-fix-active-0-day-flaws/
https://mastodon.social/@Mndell/109318142262211906-
AN OPEN SOURCE LAWYER’S VIEW ON THE COPILOT CLASS ACTION LAWSUIT
In short — it’s bad, and weird, and bad. The worst outcome from this is a situation where output from a model is copyrightable, meaning that any AI produced content would be copyrighted.
https://katedowninglaw.com/2022/11/10/open-source-lawyers-view-on-the-copilot-class-action-lawsuit/-
-
The Great Crypto-Cop Brain Drain
https://www.wired.com/story/the-great-crypto-cop-brain-drain/-
-
-
A bit more here:
https://mastodon.social/@LukaszOlejnik/109318783304732083-
A predictable disaster over at Twitter.
Well, with Twitter's new "Verified" badge system, let me just say to @elonmusk, "Sir, Mission Accomplished!" 🏆
-
-
-
-
-
Start the conversation: