Remember when we were all techno-optimists who thought we would end up with 401Ms and even 401Gs? We're as dumb as the flying-car believers.

He was here to save our asses. We should have shown a little gratitude.

They primarily manage company-internal CAs for big businesses, which they seem to do well. AFAICT, they noticed that their security infrastructure was compliant for managing a global CA, and thought they might as well also have that as a product. However, there are some operational differences between an enterprise CA and a public one, including that companies want to issue client certs to employees but nobody really does global client certs. That means that they had an intermediate CA for global client certs that they never used, but it was in the standard trust store, and nobody tested that it was handled right until Wayne just went through the standard trust store making sure a new certificate weakness detector didn't give false positives.

So eMudhra correctly handled all the certs they issued, and all the certs they used to sign them, but they got some extra CA certs trusted that they didn't really need, because it would make their side business more similar to their main business, and this caused a major problem.

Chances are that they actually got a real random number out of a HSM for the bad CA certs, but accidentally made the certs with the index of the random number instead of the actual number. (That is, they got the 4th random number and made a cert for 4 instead of the number.) I wouldn't be surprised if they stored the correct private key, which would have made leaf certs that didn't validate because the intermediate was wrong, but they never used it to find this problem.

The email wasn't even too good to be true. The nasty phishing emails are the ones where the recipient is supposed to get a real email on the topic, but it's because of a publicly known event and outsiders could easily make up the content, so they just need to find a bunch of likely recipients.

I think the "you've been assigned the mandatory phishing training" emails should come from an external sender and contain a link to get into the extended training, and you should only get the short refresher by finding it through verified sources. Not only would this be a good placement test, it would test that official communications are actually hard to fake and possible to verify using the process in the training.

"In response to the embarrassing data breach that hit the news recently, we've assigned every employee at the company an online training session about phishing at this link. By sure to take it immediately, because it's a legal requirement for our settlement and delays could affect your employment." --Russian Hackers

I love the idea of Facebook money being used to teach kids how to block advertisements. $25B should be enough to teach every single kid in New Mexico how to do it, going forward forever, as a permanent addition to public school curriculum.

I was going to suggest that maybe we could even use a tiny portion of the money to establish a state DNS server that blackholes the adservers the way pi-hole does. Then kids stuck running proprietary "apps," instead of accessing things through their Manifest-V2-compatible web browser, wouldn't have to install their own DNS server.

But then I realized the aforementioned ad-blocking curriculum ought to have resulted in every kid building their own pi-hole at school anyway, so a state pi-hole is unnecessary.

Only if you upgrade to goldtooth.

So every kid needs to have a brokerage account now?

No, each kid needs to get an X ("The Everything App") account.

Normally, you don't license media (whether it's digital or analog is irrelevant). That CD or tape or vinyl record is sold, such that you own that copy. Title is transferred just exactly the same as how title is transferred when you buy (not license) a loaf of bread, or a screwdriver, or a book. (WARNING: Though I say "normally," what's normal does change. I'm aware that a lot of people use proprietary streaming to consume media now, instead of playing locally-stored purchased copies, and those people likely did agree to a licensing contract rather than purchasing anything.)

But with software, they've been claiming that a piece of paper that they inserted into the box, retroactively causes the sale to not have really happened, even though the information that the sale was a fraud, is hidden inside the box until after the fraud has been perpetrated. The customer thinks they bought the box rather than licensed it.

There was some monumental decision reinforcing this a while back. I'm not sure this is the best example, but it's well-illustrated in this decision in favor of Blizzard against a cheatbot named Glide, where the judge supports the outrageous assertion that WoW purchasers actually did not purchase what they thought they purchased. And then instead of throwing Blizzard's executives into prison for a decade to deter future fraud, he found in their favor instead. Dirty judge. He actually fucking says this:

section 3 of the EULA provides that Blizzard explicitly retains title to “all copies” of the game client software

[emphasis mine]

For whatever reason, nobody's tried that outside of software (that I know of). I still haven't seen a EULA packed in a loaf of bread or a music CD case. But maybe some day....?

You wouldn't necessarily be wrong to expect this form of fraud to happen some day, so perhaps you're right that Congress should nip it in the bud ASAP. Sure, ok. But Congress is normally reactive so it also makes sense they're seeing it just as software problem. None of their constituents are complaining about media companies defrauding them, just software companies.

More people should spend more time trying to enjoy their own lives instead of obsessing over what other people are doing

I mistook your sig for a final paragraph in your post, and did a double-take!

Reading other people's code is a big part of how I learned to do things. I enjoyed Abacus' "Anatomy of the Commodore 64" for it's commented disassembly of the C64 ROMs. But it was easy for that to make sense, because it had been written in assembly language.

But once you're looking at to binaries compiled from higher-level languages, it gets more complicated to .. uh .. recreate the original intent.

Now they got computers to do that? Fuck yeah!

They wouldn't be talking about this stuff if they weren't trying to scare people into giving them regulatory capture.

Instead, the people running the AI need to be charged for any crime it commits and go to federal prison. Then these random little "rogue AI" incidents would stop instantly.

But this is a count-in too. He even wrote the first line of the song for you.

Shitstorm because of AI
The computer is making me cry
Hallucination's a bitch
But they say it'll make me rich
[first guitar solo]

D'oh. Mod me down; I deserve it for my fuckup.

the game's uncommon method of generating galaxies of incomprehensible scale on device consistently for all players from a single-seed happening on a phone is remarkable for those of us who remember phones performing far behind consoles or desktop PCs.

No it isn't. Your phone is a supercomputer by 1980s standards, and seeded generation (whether from a PRNG or hashing coordinates or whatever) goes back to at least then (and probably '60s/'70s). I'm not slamming the game, and seeded generation is often a good idea, but the idea that you can do it on handheld supercomputers is not remarkable, even the tiniest little bit.

You wanna see something super-fucking-impressive on an iPhone? Go back to the very first model and behold that it runs a truly-remarkably decent web browser. That was way more futuristic than this.

Of course people should beware. Anyone who has a problem with Flock is surely aware that they are only a fraction of "the problem," though among the more visible.

I'm concerned that some Flock haters might take us down a slippery slope to where you can't have a camera in your house if it looks out onto the street, or that you shouldn't be allowed to record cops, or that I shouldn't be allowed to have a camera attachment on my Manhattan apartment balcony telescope that I normally just use to furiously goon to the good people of NYC who don't close their curtains. (Oops, forget that third example.)

I can't say I'm a fan of Flock but if their rights are infringed in a way that might possibly expand to everyone else, then they will need to be defended.

That said, I have a modest proposal for the law-enforcement-related problems of surveillance vendors. Require non-warrant sharing with LE to be unreliable. For every geo search, remove a random half of the applicable results and replace them with deliberate, randomized false positives, so that LE will know the data shouldn't be taken too seriously on its own. If cops act without confirmation while KNOWING it's _at least_ 50% likely to be wrong, that'll help with the civil suits for false arrests.

HEIC is worthless because it's illegal to implement unless you get permission. Maybe in 20 years it'll be usable.

Don't like that fact? Then we need to find and support (oh no, and be?) political candidates who oppose software patents.

You shouldn't need anyone's permission to write a computer program. It's infuriating.