3 ms·
I can't tell if the logic was "we shouldn't have these keys so the certs are blown" or "watch, I just compromised the certs!" Either way, it's very much a case
by Bartweiss 9y ago
I can't tell if the logic was "we shouldn't have these keys so the certs are blown" or "watch, I just compromised the certs!"
Either way, it's very much a case of "my neighborhood isn't safe - because I keep committing crimes there."
edit: Oh, reading the Mozilla page it's also "we allowed code injection on the cert generation page". That's even worse.
- pilif 9y agoAlso, that script was running as root https://mobile.twitter.com/taviso/status/969230138956136448 https://mobile.twitter.com/taviso/status/969230138956136448
- Bartweiss 9y agoHah, seriously? ...I wonder whether the keys would have been more or less safe if, instead of all that, they just uploaded them unsecured to Pastebin. At least then they might have gone unnoticed, instead of being handed straight to possible bad actors.