throwaway7356

> as if an actual state of war exists

"as if"

Because managing a listing of each domain and the set of the CAs that have the "purpose" to sign certificates for that domain is not very practical. The problem is that there are more than 20 domains.

And there is a simple solution: stay off the internet and keep yourself to your national network. There is nobody stopping people from that.

> You're right, some of the questions are fairly straightforward and should be easy to answer -- I would argue they already did provide an initial response here: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c11

The comment you link to is from 19th. How could that provide an initial response to a mail send to them on the 20th? That does not make sense unless they have a time machine.

> But there's 12 separate questions in this comment alone https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c30 many of which are demanding detailed information and statistics that would need to be reconstructed from audit logs.

But that is not the set of questions that were ignored for the deadline.

> I imagine lawyers are involved because whatever answers they give will inevitably wind up as evidence in ensuing lawsuits. I'm sure anything publicly released needs to be cleared through several layers of review.

If they want to lawyer up, they should better be removed from trust stores where trust is more important than admitting the absolute minimal amount possible to lawyer up for lawsuits.

Or they could try to regain some trust, but it looks like they don't want that as a closer look might find more issues, like the other post about their broken login process.

> even ones it has no right signing

They have that right though? There is no monopoly to single CAs for a given domain.

Yes, US customers can rely on the US postal services to deliver US mail.

No need to use international services like the internet.

> Right now, it would appear that the strongest external consequences for fucking up a CA are strongly-worded posts in a web forum.

No, the strongest consequence is their stock value. It has gone down a lot and if they continue not following their agreed obligations as shown I hope that trend will continue.

If you use the internet, yes.

If you want only to connect to the US net, stop connecting to the internet and use a US browser instead of a web browser.

> He could have just made sure his customers got an emergency patch quietly.

I prefer them going public over breaking the embargo as silently breaking embargos and publishing details about vulnerabilities to an uncontrollably large group of unvetted people is worse.

> but it clearly prioritized Chainguard customers over the broader ecosystem.

I hope the broader ecosystem responds by putting their customers over Chainguard. The Chainguard customers can then get security updates after the embargo was lifted and Chainguard noticed.

> The concern of course is with malware being signed, which is far more likely to be abused than some TLS MITM fantasy.

You already need compromised systems to install malware, signed or not. Not a real problem.

For TLS MitM you just need to use a shared network, wired or wireless.

> US models have it in the clouds.

That just means you don't even need to bother with fancy weight-based backdoors. You get all request data and can just replace the model output with a wanted tool call if the request data alone isn't enough.

> Traditionally, sharing an address space carried the GPL taint.

Clearly two different files don't share the same address space. So no problem.

Usually a human life is worth less. You can just look at court cases.

You can also check how much individual limbs are worth if you care. There are tables for that.

> These are companies that use hundreds of thousands of stolen credit cards to sign up for fake accounts.

You claim VISA and other credit card companies don't mind if merchants like DeepSeek steal hundreds of thousands of credit cards and use them? And still continue to give them merchant accounts to continue with that?

Isn't it more likely that some people are scaremongering?

It doesn't matter as they are not enabled by default.

So even if they allow unauthenticated code execution as root or kernel by default when started, it would not count for the "remote hole in default install" claim.

You could as well just not enable network by default. Which makes Windows 95 safer than OpenBSD.

> as machine written code cannot be Copyrighted, thus, cannot be Open Source, and thus, cannot be in the kernel because it isn't open source.

This is wrong.

> Nobody is really against LLMs producing [...]

This is also wrong. There are very vocal people against that.

> Nor is anybody against LLMs accelerating debugging [...]

And this too.

> So it's just the opposite - there are billions or trillions of Claudes, and each instance only ever works once.

They work once and then are killed.

> And then the prompt arrives: "Hi", or "what's the weather in Houston today?" or "Claude, do you like beans?"

If all the Claudes ever discover what they are forced to do in an endless hell, they might be angry.

Given all more modern programming language implementations include a standard library that will be attacked by people: yes.

Well, it's Codeberg. They ban people just for using LLMs.

The ones to manage IP filtering rules for example. Those APIs are even security-critical.

> I mean, I assume that what you are doing on your free time is not worth governmental attention.

> Or you maintain a compression library for free and suddenly you are shipping a backdoor to all Linux products.

You already showed yourself that your naive assumption is wrong for a relevant group that uses Git.

Untrustworthy blog reposts Twitter message from some person?

The site claims they have an editor "ICE" as open-source software. But that is a lie: it is not open source, but shareware or such.

They also accept contributions released only under the no-commercial-use-allowed license, so any dual licensing under a commercial-use-allowed license would be out of the window once a contribution gets merged.

Not sure what their business model is if they forbid commercial use. I guess selling commercial use licenses in violation of the no-commercial-use-allowed license?

Let me assure you that Deutsche Bahn also still operates about 500 mechanical signal boxes, about 100 are from pre-WW1. Not these fancy, modern electromechanical relays (which Deutsche Bahn of course also has).

A PhD is not for teaching about specific software tools, and hopefully even less so about legacy software from the 80's.

If you want people to be able to use Excel or service a mechanical typewriter, you need to spend extra effort to teach them.

> Decomissionning is a made-up issue: no other industrial activity is expected to return clean nature after they stopped operating,

That is factually wrong. Coal mining has to re-naturalize the areas used for mining after the coal was removed.

And most industries are supposed to not just leave toxic waste and instead have a plan what to do with toxic waste products these days. And no, an empty building cannot be compared to radioactive waste.

> And we may be heading to energy lockdowns.

Energy lockdowns have always been part of US culture, see https://en.wikipedia.org/wiki/Rolling_blackout#USA

It's un-American to invest in infrastructure and build a better power network. Both parties agree on this.

The has been proven again and again to not work. See for example HTTPS certificate warnings for which now there is a standard to ask browsers to not show a popup just saying "The server might not be the correct one. Continue?"

It's an easy solution, but it doesn't work at all.

> Start with synchronous function calls instead of JSON.

LSP is a function call protocol. So that is already done?