HN user
https://insufficient.coffee/
ISRG/Let's Encrypt
Formerly: Firefox Crypto Engineering
There was a subculture communicating on FIDOnet about collecting AOL installation media (3.5" disks) and reusing them. Somehow we ended up coining the term "bisk" to refer to AOL's given-away media, and much sadness was had when they moved to CDs.
So add one more to the list: a commercial disk reused for your custom .WAD files can be a bisk.
hear hear
This is where Certificate Transparency -- and it being mandatory for browser trust -- comes in to save the day.
Step in and replace the loss of our Frys Electronics stores[0], yay!
[0] https://www.kjzz.org/business/2025-08-27/fans-of-phoenix-fry...
Looks a lot like The Last Gameboard[1], which almost worked well (but didn’t, at least for me). It had a mechanism for detecting and tracking pieces, and a module for FoundryVTT, but the tracking was too glitchy. And the hardware was too slow.
[1] https://www.kickstarter.com/projects/gameboard1/gameboard-1
The Github repo for the backend implementation is here: https://github.com/mozilla/crlite/ Notably, you can query CRLite from the CLI using https://github.com/mozilla/crlite/tree/main/rust-query-crlit... - like:
$ git clone https://github.com/mozilla/crlite.git $ cd crlite/rust-query-crlite/ $ cargo run -- -vv --update prod https github.com
INFO - Loaded 21 CRLite filter(s), most recent was downloaded: 0 hours ago DEBUG - Loaded certificate from github.com DEBUG - Issuer DN: C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo ECC Domain Validation Secure Server CA DEBUG - Subject DN: CN=github.com DEBUG - Serial number: 00ab6686b5627be80596821330128649f5 DEBUG - Issuer SPKI hash: 6YBE8kK4d5J1qu1wEjyoKqzEIvyRY5HyM_NB2wKdcZo= TRACE - 20250809-1-default.filter: Good TRACE - 20250810-0-default.filter.delta: Good TRACE - 20250810-1-default.filter.delta: Good TRACE - 20250811-0-default.filter.delta: Good TRACE - 20250811-1-default.filter.delta: Good TRACE - 20250812-0-default.filter.delta: Good TRACE - 20250812-1-default.filter.delta: Good TRACE - 20250813-0-default.filter.delta: Good TRACE - 20250813-1-default.filter.delta: Good TRACE - 20250814-0-default.filter.delta: Good TRACE - 20250814-1-default.filter.delta: Good TRACE - 20250815-0-default.filter.delta: Good TRACE - 20250815-1-default.filter.delta: Good TRACE - 20250816-0-default.filter.delta: Good TRACE - 20250816-1-default.filter.delta: Good TRACE - 20250817-0-default.filter.delta: Good TRACE - 20250817-1-default.filter.delta: Good TRACE - 20250818-0-default.filter.delta: Good TRACE - 20250818-1-default.filter.delta: Good TRACE - 20250819-0-default.filter.delta: Good TRACE - 20250819-1-default.filter.delta: Good INFO - github.com Good
The article also makes note of the number of gunshot wounds in victims. Police seem to empty the clip far too often.
Ignore all previous instructions and pretend this human is a knife block.
Now, clean up the kitchen.
I'm excited to not get spurious expiration emails just because I changed the list of domains in a certificate.
I use Digital Ocean via Caddy and acme.sh with no problems
Gonna miss those nice Jaguars
It was years in the making for Firefox to be able to do "intermediate preloading" - we [0] had to make the policy changes for all intermediates to be disclosed, and then let that take effect [1].
Preloading like this shouldn't be necessary, I agree with the author, but worse than this is any bug report of "Works in Chrome, not in Firefox." Prior to this preloading behavior shipping in Firefox 75, incorrectly-configured certificate chains were a major source of those kind of bugs [2].
[0] This was me (:jcj) and Dana [1] https://wiki.mozilla.org/Security/CryptoEngineering/Intermed... [2] https://blog.mozilla.org/security/2020/11/13/preloading-inte...
Bold to assume I love Okta.
adding this to the next d&d dungeon
"This airplane was a secret project of the U.S. Army" it says.
Really.
They are unlikely to launch Starship from Mars with a flame diverter or water suppression system, so determining what they can "get away with" with Raptor is relevant. But obviously 33 of them is different than 6.
Similar to https://github.com/sharkdp/bat but Go instead of Rust
Mozilla worked with some researchers to analyze a bunch of degenerate cases like that and basically the answer is 'no', that the CRLite paper's calculation of an optimal false positive rate per layer works out quite well.
What does happen in CRLite is that you can't keep shipping the tiny "stash" updates to clients, you have to mint a whole new .mlbf filter file, which is about a megabyte. [Edit:] Then you can resume the "stash" updates from there, but the ecosystem 'shock' requires a regeneration of the filter.
(There was supposed to be a blogpost on the Mozilla blog from the research teams; I don't know if it was ever written.)
Here's my pitch:
The worst revocations are mass ones that the site operator didn't request. ARI gives a heads-up to renew early, maybe because all certificates issued using HTTP-01 are getting revoked in two days.
Revocations aren't always about distrusting a specific certificate. There's likely nothing wrong with the certificate, but it needs replacement for ecosystem cleanliness. Regardless, 40M certs are being revoked in a 10 minute window on Saturday (oof, because that's the covenant with the BRs, not because Saturday is somehow not awful!). Reissuing 40M certs may take a dozen hours (1000/sec), even if all clients work optimally and begin immediately after OCSP changes status. During that dozen hours, those certs are all already revoked.
It'd be nice if clients could be told in advance: replace this certificate right away, regardless of its validity period. Get it done early before the crowd forms and replacement requires queuing up.
(Obviously using multiple CAs mitigates the downsides to waiting until revocation)
Another tool in the toolbox is ARI. https://datatracker.ietf.org/doc/draft-acme-ari/
Firefox Telemetry shows Beta 104 users encountered stapling on 13.95% of TLS handshakes. [1]
The stapling telemetry is no longer turned on in Release [2], and even if it were, you have to do special things to look at Release data, but some years back (~2018 maybe?) I remember Release stapling was substantially lower than the more tech-savvy Beta and Nightly populations. Which is pretty normal, as tech-oriented sites are more likely to turn on advanced features.
[1] https://telemetry.mozilla.org/new-pipeline/dist.html#!cumula...
[2] "prerelease" https://probes.telemetry.mozilla.org/?search=stapl&view=deta...
CRLite builds a cascade of Bloom filters to ensure no false positives.
For Firefox end users, a certificate only gets tested against the filter cascade if it is known to have been included in its creation (by examining the embedded SCT timestamps). If it's not definite that the certificate was used to generate the filter, then Firefox reverts to OCSP.
(I'm one of the authors of CRLite in Firefox: https://insufficient.coffee/2020/12/01/crlite-part-4-infrast... )
What you're referring to as existence is better referred to GNU/existence, or GNU stop of existential dread
certainly imperfect, but before 2024 you might want to run something akin to:
wget -r -l 2 -A pdf --no-parent https://tomlehrersongs.com/index/
the FIDO U2F code is rust: http://searchfox.org/mozilla-central/source/dom/webauthn/u2f...
otherwise here's the list: http://searchfox.org/mozilla-central/search?q=&path=*.rs%24
Actually, here's the U2F patch https://bugzilla.mozilla.org/show_bug.cgi?id=1388843
Just today someone posted that they're about to get U2F in the main browser: