basilikum

Here is the URL encoded in base64 so HN does not break it:

aHR0cHM6Ly/wn4WC8J2WjfCdkKTigpvhtZbwnZKTLuKTnPCdlaDwnZKD8J2Tsi/wn4aG8J+Gg/CfhbU=

How do you plan on reopening them again after you've closed 443 and 22?

What kernel is the router managing these VLANs running?

How many of them openly attacked and rejected to democratic process itself? How many of them did not accept the result of an election?

It's called rubber duck debugging.

It's not centralized.

You were a kid in a parallel universe then. Hacking always meant creative, unconventional and most importantly curious use of technology. The wider public just did not know or understand that.

It can hurt your credit score.

> Gemini 4 Argon called human consciousness “a PR department.”

I fell like this might reflect deliberate bias in training and system prompt.

It was the reality with Kia a few years ago.

The exact bug was reported two times in the past. But only as DOS and incorrectly patched. Clearly people actually read the code.

Private keys are not exactly open source. I mean in this case they kinda were, which is why they were found, but the point stands.

are there really so few static web sites?

Is there already a name for the vuln?

If not I suggest PHenomenalPhail.

It's guaranteed to happen.

Coming back to this 7 days later I think I understand what you mean.

The site content is authenticated with the symmetric key.

The symmetric key is authenticed with the private key.

That led me to jump to the conclusion that the content is transitively authenticated with the private key. But the security model of symmetric and asymmetric authentication schemes is of course very different. The server's private key is never disclosed so you cannot use it to forge the key exchange. But the symmetric key is of course shared and only defines a single level of trust: You either have it, meaning you can both verify messages but also sign arbitrary messages. For the purpose of transport security that is perfectly fine as both parties have full trust in each other for this purpose (the whole point is to guard the connection against anyone else), but for public authentication you need an asymmetric structure that allows verifying without the ability to sign. Symmetric cryptography by design does not enable this.

It is irrelevant that the symmetric key is authenticated with the server's private key because the presupposition that the symmetric authentication works is flawed. Verification by the untrusted public is a different scenario from verification by the two trusted parties of the communication and the presuppositions do not carry over.

Slight specification:

When you're using a modern browser that browser will require any certificate to have a certificate transparency log stamp. Certificate Transparency logs are public append only logs of issued certificates.

So you access example.org. Your ISP uses the compromised CA certificate to create and sign a rogue certificate for example.org. It now has to submit this certificate to a public certificate transparency log and gets back a proof for that. Now it can use that rogue certificate and the proof that it's in a CT log to impersonate example.org and MITM your traffic.

CT does not prevent compromise, but it makes it far easier to detect. If the people behind example.org have a look at the CT logs they will see the rogue certificate there that they did not request. This makes rogue certificates and by extension CA compromise detectable. So your ISP cannot just do this forever in secret.

Yes.

It doesn't cease to amaze me how uncreative attackers are time and time again. A cryptominer in 2026? They really earned the three cents they are getting out of that.

NileBlue

Because all these delusions are naturally allergic to the concept of empirical evidence.

If I had more time I would have written a shorter essay.

They don't care that the dates of the astrological signs have shifted and assign zodiac signs to you that have nothing to do with the constellation of stars at your birth, so I have a feeling they won't care about that either.

Yeah, but I mean I made a search for it and it's a non official MIME type but OC did not make it up in the comment. It seems to be in sparing use.

text/x-ansi is real? Wild

I appreciate people putting effort into writing. For one because I intrinsically value human effort, expression and connection as others have already argued, but also because one can only become a better writer by practicing. I am very much willing to be subjected to someone's practice as long as they genuinely put the effort into it.

And most importantly writing is thinking: https://paulgraham.com/words.html And not writing is not thinking: https://paulgraham.com/writes.html

We cannot have actual discourse, disagreement and learn from each other, and sometimes even from the process of writing something out itself without writing; or at least not nearly as good — verbal discourse can be valuable as well, but has different limitations and we live in a world where it is getting less and less.

If we let AI write for us we let it think for us.

"Which is why the Matrix was redesigned to this, the peak of your civilization. I say your civilization, because as soon as we started thinking for you, it really became our civilization"

Good writing is not taking a list of the top ten literary devices and just pouring them into your text without any intent.

=== Start of Comment ===

I don't like this.

I don't really know how to describe this any better. I have JavaScript disabled by default and got a decent lightweight blog index. The comments here on HN didn't make much sense so I enabled JS and WebGL. An image starts to load before I get this screen: "This scene needs WebGL, which isn't available in this browser." Cool. So I try a different browser and it works, but is very laggy.

I dunno. I guess it's an impressive tech demo. I mean 3D rendering in the browser is not new, but it's impressive that AIs can do something like this. It doesn't look like total crap. I guess it looks kinda neat.

But it's a terrible user interface. It would be cool if it was some handcrafted art. Not useful but human expression through sweat and dedication.

But this is an autogenerated remix of other people's art as it looks from the credits. Arranged in a 3D scene. So it's an extremely impractical user interface for what? Looking pretty? Making me go "wow"? I mean fair, that's subjective and if people feel that way that's fair.

I don't. I don't like it. I appreciate that there is a JS free version. I like it much more.

=== End of Comment ===

=== Start of Rambling ===

Now some unfair nitpick.

When I was on the JS free version and did not know why this site is even submitted here I clicked on the post about Electron. The decent blog index made place to some dreaded slop blog page. This quote struck out to me:

> But: You might be surprised to hear that performance is not the primary reason why many Electron developers prefer a bundled engine.

I am in fact not surprised at all.

I just feel that this is descriptive.

=== End of Rambling ===

I'd guess it has something to do with Proton Mail's End to End Encryption. They might generate separate keys for each email address or add DNS records for autocrypt.

> There are no smart people or stupid people, just people being smart or being stupid.

Yeah, no. When someone is constantly being stupid they are stupid. That is what that word means. Sugar coating that is just fake positivity.

"Smart" people realize that smartness is not binary and that there all sorts of things that can influence people's smartness in a situation or on a topic other than intelligence. Very intelligent people absolutely do stupid shit. Emotions, ideology, pride, wishful thinking, laziness, arrogance, just refusing to understand something etc. can make the most intelligent people really dumb fucks.

But there absolutely are stupid people. Sometimes they have the potential to be smarter by actually using the brain capacity they have but don't use for one of the aforementioned reasons. Sometimes people are just really unintelligent; Which is fine. There is no moral failing in this. Being unintelligent but good person is perfectly okay. The real issue here is that we judge people based upon their intelligence – or rather our perception of their intelligence, which is often skewed – rather than what they do with the intelligence they have, something they can control. Nothing wrong with being unintelligent, but being purposefully stupid because it serves your point or interest is unacceptable.

In the end smartness is also an overloaded term that we project all kinds of different things into.