On the caring continuum, I am right here.
Terran Empire
Joined December 2008
- Tweets30.9K
- Following700
- Followers715
- Likes68K
So much whining about Haiti from individuals who are not in Haiti but instead in the US, Canada, etc.
Happy to drive them to the airport if they want to fight alongside the gangs instead of grifting here as fake refugees.
Rock Steadfastson retweeted
ACTUALIZACIÓN DEL RESCATE A SOLDADOS SALVADOREÑOS EN HAITÍ.
La Policía Nacional de Haití y la fuerza multinacional ejecutaron un fuerte asalto directo contra la base central de la banda de "Chen Mechan" (cuyo nombre significa "Perros Malos" en criollo haitiano) en Santo, Croix-des-Bouquets.
Las fuerzas armadas lograron romper las barreras físicas e ingresar al cuartel general del grupo criminal; sin embargo, los pandilleros ya habían evacuado por completo el lugar justo antes de la llegada de los uniformados.
Debido a este repliegue, el operativo no logró localizar en ese punto a los cuatro militares salvadoreños secuestrados, quienes continúan desaparecidos mientras las tropas aliadas mantienen la ofensiva en la zona.
Mi contacto confirma que tres de las bandas más peligrosas de la llanura ("Lanmò 100 Jou", "Chen Mechan" y "Jeff Canapé-Vert") acaban de unificar sus fuerzas en un bloque de resistencia unificado.
Rock Steadfastson retweeted
あまり騒がれていませんが、中間CA証明書8枚の秘密鍵が漏洩・破られたというインシデントの方も、重大じゃないですかね。
ブラウザ各社が即日ブロックしたので「もう対処済みでしょ」という空気になっていますが、中身を見るとかなりヤバい話なんですよ。
まず「漏洩」と言っていますが、実態はもっとひどいです。鍵はECDSAで、公開鍵は「秘密鍵d × 基準点G」で作られます。dが巨大な乱数なら、公開鍵から逆算するのは事実上無理です。これがいわゆる楕円曲線離散対数問題で、ECDSAの安全性の根っこです。
ところが今回のdは、4とか56とか115とか、256未満の小さな整数だったんです。1から順番に試せば一瞬で当たります。つまり公開されている証明書さえ見れば、誰でも秘密鍵を計算できてしまう状態でした。
しかもこの鍵が作られたのは2025年4月です。約1年半、世界中の誰でもこの鍵を手にできたことになります。普通の漏洩なら「どこから誰に漏れたか」を追えますが、今回はそれすらできません。すでに誰かが使っていたかもしれない、という前提で考えるしかないんですよね。
で、中間CAの鍵を持っていると何ができるか。ざっくり言えば、どんなドメインの証明書でも「正規品」として自作できます。Googleでも銀行でも何でもです。ルートCAから信頼されている中間CAの署名なので、ブラウザは普通に信じてしまいます。
あとは公衆Wi-FiやDNS汚染、BGPハイジャックあたりで通信経路を押さえれば、鍵マークが付いたままMITM（中間者攻撃）が成立します。ユーザー側からはまず気づけません。
eMudhraは「エンドエンティティ証明書は1枚も発行していない」と説明しています。でもこれ、正直あまり意味がないんですよね。攻撃者はCAに頼まず、手元の秘密鍵で自分で署名すればいいだけなので、CA側に発行記録なんて残りません。CT（Certificate Transparency）ログに載せずに作ることもできます。CTを強制していないクライアントなら、それでも普通に通ってしまいます。
さらに地味に怖いのが、8枚のうち2枚がコード署名用だったことです。マルウェアに「ちゃんとした発行元の署名」を付けられるので、話はWebだけに収まりません。
「でも失効したんでしょ？」という話もありますが、ここも安心できません。
CRLやOCSPによる失効確認は、確認に失敗したらそのまま通すsoft-failの実装がまだまだ多いです。そもそも失効確認をしないものもあります。
ChromeはCRLSet、FirefoxはOneCRLという独自の仕組みで即座に止めたので、ブラウザは比較的大丈夫です。一方で、JavaやPython（certifi）、Goなどが抱えている独自のCAバンドル、古いOS、IoT機器なんかは、トラストストアを更新しない限り無防備のままです。MozillaとGoogleが中間CAだけでなく、署名元のルート（emSign ECC Root CA - G3）ごと信頼ストアから外したのも、たぶんこのあたりを見越してだと思います。
個人的に一番引っかかっているのは原因の方です。キーセレモニーのスクリプトのバグでHSM上に弱い鍵ペアができてしまい、名前が似ていたせいで人為ミスでそっちをCSRに使った、という説明でした。
CAの鍵生成って、監査人立ち会いのもとで厳格にやる、PKIで一番神経を使う手続きのはずなんですよね。そこでこれが起きて、しかも1年半誰も気づかなかった。CAの監査や運用の仕組みそのものへの信頼が問われる話だと思います。
サーバーや開発環境を見ている方は、念のためOSのCAバンドルと各言語のトラストストアを最新にしておくのがおすすめです。
emudhra.we-have-a-problem.co…
皆様に、今夜に対応して頂きたい大至急のお願いです。
多くのウェブサイトで使用されているPHPに関し、PHPのセキュリティチームが、重大な２件の脆弱性に関する注意喚起を行っています。
公開しているウェブサイトでPHPを使用しているか確認し、今夜、10月21日午後11時（日本時間）に公開される修正パッチについて、可及的速やかに適用できるよう準備をお願いします。
修正パッチを速やかに適用することが困難な場合は、例えばウェブサイト等を一時的に停止させることも、リスクを低減させるための有効策の一つと考えられます。
国家サイバー統括室のXアカウントでも関係する情報を発信していますので、そちらも参考にして下さい。
国家サイバー統括室(注意・警戒情報)（@cyber_forecast） / X
Rock Steadfastson retweeted
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
The cat next door is in the window, with his head turned away from me. He is huddled up starving to death because I do not immediately get up to rescue him with tuna.
Once resuscitated, he disappears in a puff of satiety not to return until the next day.
We can only wish we had leadership like this.
Pou chèf gang yo ak manm gang yo k ap kenbe kat konpatriyòt nou yo an otaj ann Ayiti:
Mesye nou kidnape yo pa konbatan. Yo se teknisyen nan domèn avyasyon ki fè pati misyon nou ann Ayiti, nan kad yon misyon entènasyonal. Misyon nou an gen sèlman pilòt ak pèsonèl teknik, ki gen kòm travay prensipal fè evakyasyon medikal epi sove lavi moun, pa fè lagè.
Men, nou te kidnape yo yon fason lach pandan yo t ap retounen apre yo te fin achte manje nan yon makèt nan zòn nan.
Se poutèt sa, jodi a nou te lanse yon operasyon militè pou pote yo sekou. Nou gen yon sèl objektif: fè kat konpatriyòt nou yo retounen lakay yo vivan, san okenn mal.
Men, mwen vle pou nou menm, chèf gang yo, konprann yon bagay byen klè: atak jodi a pa anyen devan sa k ap vini si nou pa remèt toule kat otaj yo vivan.
Epi pa pran pawòl nou yo pou menas san fondman. Nou deja fini ak gang yo nan El Salvador, e nou kapab fini ak nou tou.
Nou toujou gen tan pou evite sa.
Remèt nou kat konpatriyòt nou yo vivan, san okenn mal, epi tout bagay ap retounen jan sa te ye anvan kidnaping lan.
Desizyon an nan men nou.
Rock Steadfastson retweeted
A Europa será destruída por mulheres que projetam naqueles animais a maternidade que cabia aos filhos que elas abortaram.
People are strange. So I was parked in front of my driveway on the street talking to my mother before she went home, when my neighbour across decided he wanted to go somewhere. Turned on his truck headlights, then when we didn't move, exited anyway, drove 80m down the road to
his friend's house for a few minutes instead of walking and then drove back.. and of course ended up driving over or knocking over his green bin. I got out to help pick it up but he picked it up already and seemed angry so whatever.
Rock Steadfastson retweeted
About a decade ago I became intrigued by the stupidity of the term “intersectionality”, at least as it was being used by left wing activists. It emerged out of critical legal studies, I reasoned, surely it couldn’t be completely retarded.
I had access to my schools limitless supply of academic papers, so I decided to read a few, just to understand the genesis of the term, to see whether / how it was being misapplied in a seemingly anemic way after it filtered down from the law faculty to the low iq street hustlers and racial activists.
I read the four most recent peer reviewed papers addressing the concept.
Almost 100 pages of reading and thus far all I had learned was that intersectionality was a “travelling concept”. As far as I could tell this was something akin to the sisterhood of the travelling pants, wherein the way it fits, looks and functions depends entirely on which member of the sisterhood is in possession of it.
Because I am nothing if not autistic, I then read the next previous four papers. And the next four. And the next four. . . .
Eventually I worked my way back to Kimberlé Crenshaw’s OG paper that coined the term in the late eighties. By this point t it was almost a year later (I said I was autistic!), and I had by now ingested almost 100 published, peer reviewed academic papers on intersectionality.
I have included two verbatim quotes straight from the horses mouth. Yes it’s really that retarded, no, there is nothing more to it. Yes LITERALLY EVERY LEFTIST THOUGHT TERMINATING BRAIN WORM IS LIKE THIS.
They are not theories, they are WEAPONS.
They cannot be anything but weaponised.
All of leftism is this, ad infinitum.
Rock Steadfastson retweeted
Pour moi, c'est l'image la plus horrible de ce 17 octobre:
Un couple d'octogénaire dépouillé de tout, en pleine rue, laissé à moitié nu.
Comme si les Rolex, les Vuiton, les Hermès, les Dior, les Sephora pillés n'étaient pas suffisants pour la revente.
L'image qui devrait être un signal d'alarme pour tout l'occident.
L'image d'un pseudo président qui a perdu le contrôle. Qui a totalement échoué envers son peuple.
L'image d'une gauche radicale qui a sacrifié votre propre identité pour faire de votre pays une zone de guerre, aux arrières-plans culturels qui n'ont rien à voir avec les vôtres.
Cette image est effrayante!
Fascinating. The Yookay govt slapped a label of 'tarded and in need of state protection for visiting and not hating Israel.
An absolutely chilling expression of soft power from the very top which demonstrates how far from the pale the Yookay govt is now.
What happened to me:
I was invited by the Israeli embassy to Israel because of my advocacy and went from 8-15 June last year.
A prevent referral was made because I was “over identified” with Israel (bought bagels and hummus that week) The paperwork sent with my redacted SAR shows that they had rightly said there was no legal reason to investigate me since going to Israel isn’t a terrorist act and caring about Jews isn’t worthy of investigation.
On 23 June my NHS records were changed to declare me a vulnerable adult which is someone with cognitive impairment who by virtue of their severe impairments is at risk of coercion and exploitation. The implication being that the Israelis were exploiting me.
This was done without my knowledge and with no assessment or evaluation. My NHS GP records were then made unavailable to me. This label was removed on 18 May this year also without my knowledge or any assessment.
The prevent people came to my door and asked me about my trip to Israel and whether I’d ever visited Auschwitz, they asked who I knew in Israel and whether I’d ever return.
The reason they could do that and look into me is because they’d designated me an incompetent and the reason they could do that is because I have what used to be known as Asperger’s and (real, not the modern variant) ADHD.
They used my health issues to make me medically vulnerable in order to investigate me for legally travelling to Israel on an embassy visit because I thought killing 1200 innocent people in the name of a KGB inspired propaganda creation “Operation SIG” was wrong.
The fact I had longstanding friendships with Jewish people and would help anyone didn’t matter.
I have been labelled an incompetent by the state in order to allow monitoring by prevent because I support Israel.
When I did the 7.10 speech at the JSOC at Durham University two uniformed police attended to monitor the event for hate speech. It was a memorial to murdered people, I was honouring THEM.
I find it all disturbing and terrifying.
It wouldn’t be so bad if I had not for my entire life been treated like scum by teachers, doctors, midwives and the state because I have Asperger’s and a chronic pain condition.
The truth is I’m a highly competent woman who has always managed genuine health challenges with resilience and determination and I am affronted by the state thinking they can just label me mentally incompetent because I’m a Zionist.
I found this out by accident. As I said my GP notes have been made unavailable to me but I’ve put in requests and complaints to all the relevant organisations because you cannot use my personal data maliciously in order to target me for caring about Jews and Israel. Zionism is a protected philosophical belief and I am a Holocaust scholar. You cannot on one hand have psychological reports from 2021 showing I have verbal reasoning and logical reasoning in the gifted range
and call me a mental incompetent.
This is political targeting and I will not go quietly into that good night and eat my paste like a placid subject.
You’ve done me dirty and I’m deeply aggrieved. The harm that has been done to me over decades by the services meant to protect citizens is a disgrace.
I am a good woman. I am never hateful, I am not incompetent and I will not stop using facts to counter lies.
If you want me to go away then pay for me to leave the country
P-a-t-h-e-t-i-c.
This is a stupid woman. Compatible with the Republic? Islam does not coexist or compromise. It has 1400+ years of experience subjugating very successfully and it is not going to make an exception for Le Pen, the newest useful idiot.
