Because managing a listing of each domain and the set of the CAs that have the "purpose" to sign certificates for that domain is not very practical. The problem is that there are more than 20 domains.
And there is a simple solution: stay off the internet and keep yourself to your national network. There is nobody stopping people from that.
> You're right, some of the questions are fairly straightforward and should be easy to answer -- I would argue they already did provide an initial response here: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c11…
> even ones it has no right signing They have that right though? There is no monopoly to single CAs for a given domain.
Yes, US customers can rely on the US postal services to deliver US mail. No need to use international services like the internet.
> Right now, it would appear that the strongest external consequences for fucking up a CA are strongly-worded posts in a web forum. No, the strongest consequence is their stock value. It has gone down a lot and if they…
If you use the internet, yes. If you want only to connect to the US net, stop connecting to the internet and use a US browser instead of a web browser.
> He could have just made sure his customers got an emergency patch quietly. I prefer them going public over breaking the embargo as silently breaking embargos and publishing details about vulnerabilities to an…
> but it clearly prioritized Chainguard customers over the broader ecosystem. I hope the broader ecosystem responds by putting their customers over Chainguard. The Chainguard customers can then get security updates…
> The concern of course is with malware being signed, which is far more likely to be abused than some TLS MITM fantasy. You already need compromised systems to install malware, signed or not. Not a real problem. For TLS…
> US models have it in the clouds. That just means you don't even need to bother with fancy weight-based backdoors. You get all request data and can just replace the model output with a wanted tool call if the request…
> Traditionally, sharing an address space carried the GPL taint. Clearly two different files don't share the same address space. So no problem.
Usually a human life is worth less. You can just look at court cases. You can also check how much individual limbs are worth if you care. There are tables for that.
> These are companies that use hundreds of thousands of stolen credit cards to sign up for fake accounts. You claim VISA and other credit card companies don't mind if merchants like DeepSeek steal hundreds of thousands…
It doesn't matter as they are not enabled by default. So even if they allow unauthenticated code execution as root or kernel by default when started, it would not count for the "remote hole in default install" claim.…
> as machine written code cannot be Copyrighted, thus, cannot be Open Source, and thus, cannot be in the kernel because it isn't open source. This is wrong. > Nobody is really against LLMs producing [...] This is also…
> So it's just the opposite - there are billions or trillions of Claudes, and each instance only ever works once. They work once and then are killed. > And then the prompt arrives: "Hi", or "what's the weather in…
Given all more modern programming language implementations include a standard library that will be attacked by people: yes.
Well, it's Codeberg. They ban people just for using LLMs.
The ones to manage IP filtering rules for example. Those APIs are even security-critical.
> I mean, I assume that what you are doing on your free time is not worth governmental attention. > Or you maintain a compression library for free and suddenly you are shipping a backdoor to all Linux products. You…
Untrustworthy blog reposts Twitter message from some person?
The site claims they have an editor "ICE" as open-source software. But that is a lie: it is not open source, but shareware or such. They also accept contributions released only under the no-commercial-use-allowed…
Let me assure you that Deutsche Bahn also still operates about 500 mechanical signal boxes, about 100 are from pre-WW1. Not these fancy, modern electromechanical relays (which Deutsche Bahn of course also has).
A PhD is not for teaching about specific software tools, and hopefully even less so about legacy software from the 80's. If you want people to be able to use Excel or service a mechanical typewriter, you need to spend…
Because managing a listing of each domain and the set of the CAs that have the "purpose" to sign certificates for that domain is not very practical. The problem is that there are more than 20 domains.
And there is a simple solution: stay off the internet and keep yourself to your national network. There is nobody stopping people from that.
> You're right, some of the questions are fairly straightforward and should be easy to answer -- I would argue they already did provide an initial response here: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c11…
> even ones it has no right signing They have that right though? There is no monopoly to single CAs for a given domain.
Yes, US customers can rely on the US postal services to deliver US mail. No need to use international services like the internet.
> Right now, it would appear that the strongest external consequences for fucking up a CA are strongly-worded posts in a web forum. No, the strongest consequence is their stock value. It has gone down a lot and if they…
If you use the internet, yes. If you want only to connect to the US net, stop connecting to the internet and use a US browser instead of a web browser.
> He could have just made sure his customers got an emergency patch quietly. I prefer them going public over breaking the embargo as silently breaking embargos and publishing details about vulnerabilities to an…
> but it clearly prioritized Chainguard customers over the broader ecosystem. I hope the broader ecosystem responds by putting their customers over Chainguard. The Chainguard customers can then get security updates…
> The concern of course is with malware being signed, which is far more likely to be abused than some TLS MITM fantasy. You already need compromised systems to install malware, signed or not. Not a real problem. For TLS…
> US models have it in the clouds. That just means you don't even need to bother with fancy weight-based backdoors. You get all request data and can just replace the model output with a wanted tool call if the request…
> Traditionally, sharing an address space carried the GPL taint. Clearly two different files don't share the same address space. So no problem.
Usually a human life is worth less. You can just look at court cases. You can also check how much individual limbs are worth if you care. There are tables for that.
> These are companies that use hundreds of thousands of stolen credit cards to sign up for fake accounts. You claim VISA and other credit card companies don't mind if merchants like DeepSeek steal hundreds of thousands…
It doesn't matter as they are not enabled by default. So even if they allow unauthenticated code execution as root or kernel by default when started, it would not count for the "remote hole in default install" claim.…
> as machine written code cannot be Copyrighted, thus, cannot be Open Source, and thus, cannot be in the kernel because it isn't open source. This is wrong. > Nobody is really against LLMs producing [...] This is also…
> So it's just the opposite - there are billions or trillions of Claudes, and each instance only ever works once. They work once and then are killed. > And then the prompt arrives: "Hi", or "what's the weather in…
Given all more modern programming language implementations include a standard library that will be attacked by people: yes.
Well, it's Codeberg. They ban people just for using LLMs.
The ones to manage IP filtering rules for example. Those APIs are even security-critical.
> I mean, I assume that what you are doing on your free time is not worth governmental attention. > Or you maintain a compression library for free and suddenly you are shipping a backdoor to all Linux products. You…
Untrustworthy blog reposts Twitter message from some person?
The site claims they have an editor "ICE" as open-source software. But that is a lie: it is not open source, but shareware or such. They also accept contributions released only under the no-commercial-use-allowed…
Let me assure you that Deutsche Bahn also still operates about 500 mechanical signal boxes, about 100 are from pre-WW1. Not these fancy, modern electromechanical relays (which Deutsche Bahn of course also has).
A PhD is not for teaching about specific software tools, and hopefully even less so about legacy software from the 80's. If you want people to be able to use Excel or service a mechanical typewriter, you need to spend…