Nostr notes by OOTS

I think the criticism here was that the emudhra certs are removed ...

2026-10-25T07:50:30Z

In reply to nevent1q…26q2
_________________________

I think the criticism here was that the emudhra certs are removed *by update* *only* on Android. On other Firefox build targets (e.g. desktop), the emudhra certs are removed *only* through the remote settings mechanism.

Though upon reading https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/ , that doesn't seem correct, it should have happened in 158.0.1 ...

Maybe I misunderstood something. In that case: sorry for the confusion.

CC @npub1958…x4mx

2026-10-25T06:47:19Z

In reply to nevent1q…neds
_________________________

CC Frederik Braun � (npub1958…x4mx)

The more I think about this, the more I converge on "trust on ...

2026-09-13T16:23:54Z

In reply to nevent1q…k2hq
_________________________

The more I think about this, the more I converge on "trust on first use and #TOFU don't go well together".

In reality, it would probably have to be "trust on first use, trust again after expiry and just before expiry".

If you have an attacker who can do #MitM in your home network (and without this it doesn't make sense to discuss #TLS at all), all the attacker has to do is wait for the current short-lived cert to expire and then present his/her own cert on the next connection attempt.

Plus (for automatic TOFU, without user confirmation) an attacker with MitM in your home network could do phishing with #HomoglyphAttacks or so (and inject a DNS response as he/she wants).

Revocation is a valid concern, but maybe in the "home network" case you know all devices that will connect to the compromised service and opening the browser settings on all devices to manually revoke trust in the compromised cert is a viable way to (effectively) revoke trust in the cert.

If you wanted to go for "trust on first use after user confirmation", I'd say the UI/UX should be very different from the normal UI/UX for "browser warns you about invalid cert", otherwise all of this would train users to ignore the normal browser warnings about invalid certs.

Der Gesang im Chorus/Refrain erinnert mich von der Stimme und vom ...

2026-09-08T07:45:13Z

In reply to nevent1q…5am5
_________________________

Der Gesang im Chorus/Refrain erinnert mich von der Stimme und vom Stil her ein wenig an #FarinUrlaub bzw. die #Ärzte...

This post should be a poll

2026-08-11T18:36:02Z

In reply to nevent1q…w2fv
_________________________

This post should be a poll

Shitposting as a service?

2026-05-20T15:59:03Z

In reply to nevent1q…vjrh
_________________________

Shitposting as a service?

The "Bluetooth Headphone Jacking" talk at #39c3 was ...

2025-12-27T23:18:09Z

The "Bluetooth Headphone Jacking" talk at #39c3 was awesome, too. They reversed a popular SOC that powers Bluetooth earbuds and headphones.

They found that (even without being paired to the headphone), they could dump flash and RAM from the device. Then they dumped a bunch of info from the device - e.g. the #Bluetooth address and "master" encryption keys used for the communication with paired devices (e.g. a #phone).

Then they impersonated the headphone from their laptop and connected to the phone (pretending to be the headphone).
The headphone (or the laptop impersonating the phone) has permissions to do some things on the phone, e.g. accept calls, increase/decrease volume, etc.

Then they started recovering access a #WhatsApp account via some account recovery mechanisms. That required some one-time security key which would normally be delivered via SMS, but that could be delivered via phone call as a fallback option, too. Since the phone thought it was connected to the Bluetooth headphone, phone call audio would go to the laptop via Bluetooth.

As the cherry on top, they escalated into the victim's #Amazon account.

Scary shit. #YouCannotBeParanoidEnough #security

It's end of June, and #NuclearPowerPlant|s in #France already ...

2025-06-26T15:49:45Z

It's end of June, and #NuclearPowerPlant|s in #France already have to decrease their power output because the water in the rivers is too warm to provide proper cooling.

#NuclearPower is not a sustainable, reliable source of energy unless we manage to stop the #climatecatastrophe first (which, realistically, we won't, even though we have to).

Source: https://www.iwr.de/ticker/frankreichs-atomkraftwerke-muessen-leistung-drosseln-hitzewelle-im-mittelmeer-wassertemperaturen-mehr-als-5-grad-ueber-saisonalem-durchschnitt-artikel7578

#fission #climatechange

I'd say CVE-2025-DOGE also leads to Denial of Service.

2025-04-16T04:47:44Z

In reply to nevent1q…6zch
_________________________

I'd say CVE-2025-DOGE also leads to Denial of Service.

They'll just send #doge to close down whatever office/agency ...

2025-03-03T19:12:33Z

In reply to nevent1q…4pah
_________________________

They'll just send #doge to close down whatever office/agency is calculating the inflation rates, and BOOM, no more inflation.
#uspol #trump #postfactpresidency

sounds like an LLM could be of great help here

2025-02-27T16:19:34Z

In reply to nevent1q…fu0e
_________________________

sounds like an LLM could be of great help here

The talk about advanced lithography at #38C3 was really ...

2024-12-27T19:08:06Z

The talk about advanced lithography at #38C3 was really excellent. It wasn't really technical, but it provided a quick overview of some of the incredible, mind-boggling technology that goes into manufacturing billions of computer chips with billions of transistors, at nanometer scale (a few atoms in size).

https://fahrplan.events.ccc.de/congress/2024/fahrplan/talk/ANJUV8/

The recording should be online in a couple of days.