"Meanwhile even questioning if the earth is flat will have you downmodded to (-1) Troll."

What you might as well have said.

Is that the motivation for all the AI slop hitting open source projects? People trying to pick up cheap credibility and resume points? I'm really curious why it's such a problem...

They primarily manage company-internal CAs for big businesses, which they seem to do well. AFAICT, they noticed that their security infrastructure was compliant for managing a global CA, and thought they might as well also have that as a product. However, there are some operational differences between an enterprise CA and a public one, including that companies want to issue client certs to employees but nobody really does global client certs. That means that they had an intermediate CA for global client certs that they never used, but it was in the standard trust store, and nobody tested that it was handled right until Wayne just went through the standard trust store making sure a new certificate weakness detector didn't give false positives.

So eMudhra correctly handled all the certs they issued, and all the certs they used to sign them, but they got some extra CA certs trusted that they didn't really need, because it would make their side business more similar to their main business, and this caused a major problem.

Chances are that they actually got a real random number out of a HSM for the bad CA certs, but accidentally made the certs with the index of the random number instead of the actual number. (That is, they got the 4th random number and made a cert for 4 instead of the number.) I wouldn't be surprised if they stored the correct private key, which would have made leaf certs that didn't validate because the intermediate was wrong, but they never used it to find this problem.

I can see this being used to disrupt technologies owned by foreign nationals and/or competing with USA tech whenever the private tech in the USA seeks government help with competition.
Because that's how the corruption rolls here now.

I've had a long professional development career, and the 2026 frontier models do most coding and debugging work far faster and better than me. I wish like hell that LLMs could be un-invented, but to be an effective person, one must deal with reality.

All the trust and verification issues you mention are issues with human developers as well. Even "accountability" for software faults doesn't really stick to individual developers unless it's egregious and frequent... bugs are expected. The only real differences on the software quality front are scale: the LLM can write more code more quickly, but it can also review and test more coffee more quickly.

I do agree that many orgs will fall into the trap of writing unmaintainable software simply because they don't balance that increase in scale. The great improvement is that when these systems collapse under their own weight or sing technology, the pros will be able to rewrite them much faster.

The email wasn't even too good to be true. The nasty phishing emails are the ones where the recipient is supposed to get a real email on the topic, but it's because of a publicly known event and outsiders could easily make up the content, so they just need to find a bunch of likely recipients.

I think the "you've been assigned the mandatory phishing training" emails should come from an external sender and contain a link to get into the extended training, and you should only get the short refresher by finding it through verified sources. Not only would this be a good placement test, it would test that official communications are actually hard to fake and possible to verify using the process in the training.

"In response to the embarrassing data breach that hit the news recently, we've assigned every employee at the company an online training session about phishing at this link. By sure to take it immediately, because it's a legal requirement for our settlement and delays could affect your employment." --Russian Hackers

No, in this case, the real problem is that most employees would expect a superbowl ring to come from a third party vendor. And as such, they'd expect the domain name to be a third party domain name.

These gotcha games suck, but they're necessary. And it's not just email, it's phone calls, it's social engineering, it's fake paper invoices, it's fake AI voices, it's deep fake live videos, etc.

And yes, automate your defenses, automate as much as possible, but that's not enough. Every day, there is a new scam out there, or a new vector of attack, that automation doesn't take into account yet. It's a never-ending list of problems that requires never-ending education.

And yes, let's not make fun of people, but let's assume that people are going to make mistakes (even after having been trained), so let's continue to do penetration testing (in addition to all the other precautions we take and all the defensive automation we create).

Yes, enforcement can take place *after* a police report has been made. Because if a crime has been committed, there is a process to follow and there is a criminal to catch.

After all, if a hidden camera is found, it could have been planted there by a host, or by an employee, or by a contractor, or by a previous guest, or may be the camera could have been planted by someone trying to make a fake allegation (for instance a local competitor, or a guest who's trying to extort the host)

Who knows? It's the same thing with hotels. Hotel rooms have been found with hidden cameras in them also. If you find a hidden camera in your hotel room, you do not contact their headquarters first, you do not tell the front desk first, you contact the police first! The police can secure the evidence. The police can record what happened. The police can even try to catch the perpetrator.

Does anyone actually use these browsers or is it just a ploy to soak up VC dollars?

Secret recordings should be a police issue, not an AirBnB one. It's not like AirBnB can inspect a location like the police can. And it's not like AirBnB can prosecute a case. This is a matter for the local justice system.

Or am I missing something?

The DOD/DOW have been working on this for a while. They discovered, early on, that the device had a propensity to cause permanent nerve damage.

It's very unlikely the US have fixed that, as they'd largely sidelined the work as a failure. However, at 36%, Trump needs something he can call a win, no matter what the long-term consequences.

Yeah, my Musk sycophant friend says the same whenever I express skepticism about Elon's endeavors or character. Which is funny since I rarely read Electik and my arguments aren't from there.

Yeah, this is really weird.

If I had a colleague who was accused of that, I wouldn't be drafting any letter of support unless some higher ups were forcing my hand.