2026-10-22 16:55 UTC
RE: https://infosec.exchange/@stacksmashing/117485134428857077
This press release is an awe inspiring piece of misdirection. “There were no end entity certificates issued out of the affected CA's”. True, maybe no end-entity certificates were issued by the affected CAs but the whole point is that nobody knows how many end-entity certificates were issued by other parties using the CA's signing key.
A lot of the rest is similarly beside the point.
Replies (1)
-
@fedops@fosstodon.org 2026-10-22 18:57
@edavies@functional.cafe what a complete shit show. Trying to weasle their way out instead of just owning it and saying "we'll do better." I shudder just thinking what the remaining 99% of their business are and how much worse it can get when the simple task of using a secure keyphrase is beyond their attention level.