Remote profile

"Wayne" himself noted that you'd think someone else would have checked this before be did!, which points to a process problem where there's no-one who's specifically responsible for running basic double-checks against widely-trusted certificates in general for issues like trivially recoverable private keys.

https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/JESKy8XoAgAJ

eMudhra, the company that made 4 the new funniest number, put out a press release that said the problem was discovered "possibly with AI assisted techniques" to make it sound sophisticated and difficult and not something that just anyone could discover

No, what happened is that someone bothered to run a basic cracking script on all trusted certificates to see if any of them were actually THAT damn broken, and they were. There's probably other actors out there who noticed months ago and didn't report it, keeping the broken certificates in their back pocket for a rainy day.

https://emudhra.com/en/press-release/emudhra-statement-distrust-global-tls-intermediate-root-ca

ugh. the patch is massive 🫩 the bug is based on causing an OOM condition and no-one ever accused the php interpreter of being neatly and elegantly architected, so the fix touches everything 🫩 the bugs go back many years but backporting the fix to all those versions is wildly impractical 🫩

the exploit was developed with AI assistance but it was based on existing human research, including by my old nemesis Stefan Esser. I don't remember why he's my nemesis, I assume we got into a stupid twitter argument over nothing like 16 years ago

Our router rebooted itself and started blinking ominously a few minutes before the embargo ended. I sure hope that was the ISP pushing updates for its rinkydink management interface and not someone installing a bitcoin miner in its rinkydink management interface

and for the record, I am not Eevee of "fractal of bad design" fame; I am sure people have mixed up me and @eevee before. Understandable, we're both cute girls who had a Passionate PHP Hater phase in our distant youths. But I'm a knockoff vocaloid and she's a pokemon. Completely different!

This was eevee's original extremely famous blog post: https://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/ which also largely does not apply to PHP As She Is Meant To Be Spoke in 2026, but you can use it as a guide for how not to design a language or other complex software system.

A very young little girl pet Odin; it was only after she found herself staring straight into his cavernous maw that she was like “oh, he could bite me :(“

but her mother was clearly a good judge of dog character and reassured her that this dog clearly would never bite her and to keep petting him :neodog_hug_blob_heart:

anyway I just learned that the Dutch government service websites are implemented in PHP because a national news alert has gone out that they're shut down for the day due to reasons

So, no matter how bad the PHP fallout proves to be, I have to concede that they *have* cleaned up their act quite a bit in recent years and these sorts of bugs out of PHP are much, much rarer than they used to be

Did you know that, when I was a fiery young programmer in my 20s, I ran a hate blog dedicated to the PHP manual and how bad, unreliable, and unhelpful it was? Here are some highlights:

Special snowflake not-actually-a-function isset() https://phpmanualmasterpieces.tumblr.com/post/52082199266/unsettling

The notorious strcmp() footgun https://phpmanualmasterpieces.tumblr.com/post/44634822304/i-am-so-comically-angry-right-now

When 1 equals 4096 https://phpmanualmasterpieces.tumblr.com/post/33023415508/when-does-one-byte-equal-four-kilobytes

PBKDF API designed to trip you up https://phpmanualmasterpieces.tumblr.com/post/66426423275/i-cant-spell-pbkdf

And, my favorite, a review of the complete original PHP 2.0 manual from the late 90s: https://phpmanualmasterpieces.tumblr.com/post/65544023819/php-20-a-review-in-retrospect

(The picture of Espurr in that post links to a domain that used to play the Lavender Town theme. Please put on Lavender Town yourself for full effect)

All these posts are 12 to 15 years old and do not necessarily reflect the current state of either the documentation or the code. Gods, I hope they don't.

#php

In my husband’s defense, we realized this when he decided to surprise me with flowers for an unrelated reason

Double ADHD marriage be like: realizing we both completely forgot about our anniversary weeks ago

I have a headache after trying to understand someone's blatantly Claude-generated writeup of the PHP bug. It's like dazzle camouflage for useful information

last night: I take the time to watch a funny Skyrim challenge video instead of worrying about anything important. The number 4 breaks the internet

this morning: I sleep like a functioning healthy human being. PHP breaks the internet

while we’re all discussing single-digit numbers, we could solve so many rhythm problems if we all agreed to retcon seven to “sen”

okay, I’m way too late to post xkcd “4” comic and still be funny, so instead I will have to write a serious post

Could this disturbingly severe mistake be because someone asked The Cat for a certificate? Hypothetically, yes. But there’s absolutely no reason to jump to that conclusion with self-righteous confidence when all serious infosec experts have been screaming for THIRTY YEARS that our programming languages are designed to maximize the probability of catastrophic mistakes in cryptographic code even when handled with care by experienced professionals.

Here’s what we know: several signing certificates from the same issuer with private keys that are, in their entirety, just a number below 256, all the way down to the comical “4, just 4, that’s not a typo, the private key is 4.” This strongly suggests a bug where the first byte of the intended key, treated as an array, was used rather than the whole key. A bug that’s absolutely, positively trivial to write in C and its descendants. I’ve seen proposals for how to gotcha yourself like this in Go as well.

I’m not saying The Cat isn’t involved, it could be. But you absolutely, positively do not have to ask a mischievous clawed agent for a random number for it to go this horribly wrong. We’ve always had the human strength within us to fuck up this bad all along

(And I do assume it’s a fuckup and not a backdoor, because there’s no reason to design a backdoor such that the next random enthusiast to run a sanity check script on public certificates will instantly spot it and start screaming)

you don't really think about it until it happens to you or someone close, but if you get too sick to go to school or work for months and years, then even if you're lucky enough to "get better," the knock-on consequences will just keep going for many years and possibly the rest of your life, in ways that systems aren't designed to anticipate or compensate for

A decade ago I was too sick to get out of bed and take care of myself, and I’m still having dental surgery about it to this day 😞