3 ms·

I'm wondering if anyone could explain what the "right" thing for Trustico to do?

• Ajedi32 9y ago
  They should not have offered a web form for generating private keys, and instead should have educated their customers on how to generate their private keys and CSRs on their own servers. If they had done that they wouldn't have had access to any private keys in the first place, so all their subsequent mistakes in mishandling those keys would have been impossible to make. As for the whole "arbitrary Remote Code Execution as root" on their web server, that's got a pretty obvious solution: sanitize your data inputs, and don't run your web application server as root.