u/the_gnarts

Studiert habe ich in Heidelberg und im Ausland. ;) Ich bin damals für einen Job nach Tübingen gegangen.

Mein Studium ist schon eine Weile her, aber ich könnte mir vorstellen, dass ich schon wegen der Mieten und der kurzen Wege in Tübingen bleiben würde. Oder in eine andere, entspanntere Unistadt ziehen.

München ohne Job stelle ich mir finanziell prekär vor, selbst mit Bafög-Höchstsatz.

Which do you prefer, Neckarmüller or Hofbräuhaus?

Witzig, ich habe genau diesen Umzug hinter mir und es war eine der besten Entscheidungen meines Lebens.

In Tübingen war mein Sozialleben praktisch nicht existent. Ich war einfach immer auf Achse. Für jede Veranstaltung erstmal irgendwohin fahren, weil vor Ort nix läuft, war enorm zeitintensiv. Zumal die Zuganbindung in alle Richtungen dank S21 katastrophal war und immer noch ist. Zum Radfahren und generell Outdoor-Aktivitäten war Tübingen aber phänomenal; Feierabendrunde zum Rossberg rauf, 500 Höhenmeter in 40 min ab Haustür, sowas gibt es in München einfach nicht. Auch die Lauftrails innerhalb der Stadt (Sand, Schlossberg) vermisse ich heute noch.

Mein Eindruck war, dass nur diejenigen dauerhaft in Tübingen blieben, die entweder in der Gegend ihre Wurzeln hatten oder im akademischen Bereich eingebettet waren. Alle anderen sind wie ich irgendwann weg, weil die Stadt ihnen wenig zu bieten hat. Selbst die Gehälter sind ja eher mau dort, auch wenn ich meinem alten Job aus anderen Gründen noch etwas hinterhertrauere.

Ich bin dann vor ein paar Jahren nach fast einem Jahrzehnt aus Tübingen weggezogen. Hatte mich europaweit beworben und nach einem intensiven Monat drei ernsthafte Angebote erhalten - zwei davon aus München. Der Rest ist Geschichte, wie man so sagt.

Ohne sich im voraus finanziell abgesichert zu haben, würde ich den Sprung allerdings nicht wagen. Der Wohnungsmarkt ist grauenvoll in München (ja, selbst gegenüber Tübingen noch ein, zwei Level drüber!) und der einzige Weg zu einer Bleibe ist es, nachweislich mehr zahlen zu können als alle anderen.

Die ganze Geschichte der bundesdeutschen Endlagerversuche ist ein absolutes Paradebeispiel dafür, dass Menschen nicht in der Lage sind die für Endlager nötigen Zeiträume in Plänen zu erfassen.

Onkalo zeigt doch gerade, dass Menschen dazu sehr wohl in der Lage sind.

Nur eben deutsche Politiker nicht.

We screwed up.. no one Will trust us now. So we have no choice but to exit the business

No worries. Your company name has already been immortalized in that MitMproxy flag --emudhra.

Good luck rebranding yourself out of your misery.

Ever heard of Worldcom? - Stringer Bell

Has Your PHP using Colleague(tm) actually verified you're exploitable in real world conditions? Considering how tricky it is to reproduce the PoC against arbitrary instances I'm tempted to dismiss most of the drama as engineered by Wiz marketing.

https://www.reddit.com/r/peloton/comments/15cxkyu/results_thread_2023_tour_de_france_femmes_stage_7/ju13wcd/?context=1337

A now deleted comment from 2023-07-29 23:07 UTC might have been the first ever use of the now canonical TdFHsZ acronym.

I’m the first to shit on vibecoders but I’ll also admit that putting an LLM on a complete rewrite of their aging PHP monolith in something sane could be a net positive all things considered.

I noticed that too. Given PCS runs on a huge legacy codebase written in PHP (good lord!) I expect they had a busy week a) applying security patches and b) getting bombarded by botnets trying to exploit the recently disclosed RCE vulnerability.

Video unavailable

The uploader has not made this video available in your country

There's some speculation on MDSP that those numbers were references to the keys stored on the HSM which they can transparently handle as-though they were PEM encoded private keys.

This would be consistent under a charitable interpretation with emudhra's claim that wrapping/unwrapping messed up the keys. The assumption being their scripts stripped Utimaco's custom PEM header/footers and replaced it with -----{BEGIN,END} PRIVATE KEY-----, which would the HSM then took not as a reference but as the key itself.

It seems plausible enough, but is still speculative. They've been asked for clarification without a response so far.

Do we have any evidence of them being liars as opposed to just incompetent?

Their observed behavior wrt to the CRLs they published seems to suggest that in the very least they're very selective in regards to what they're publicly willing to admit, only confirming what has already been stated by the researchers:

The CRL I gave was just one of them detected on 10-14 where they signed with OCSP certificates generated that day, and then swapped them on the next CRL issuance without reporting it to anyone. I only started monitoring CRLs very recently, so this has likely been an issue for a while. It also relates to the current claims about the Key Generation Ceremony, how they seem to be juggling what-signs-what, have no actual fix for #1970728, and are less than transparent when key mishaps happens and don't self-report.

As a CA they have committed to transparency and accountability, so even if that's not outright lying they at least are acting unethically.

Offensichtlich haben Sie keinerlei Ahnung von Hochschulbildung. In Deutschland gibt es praktisch keine Stipendien.

Der Hintergrund dafür ist schlicht, dass Hochschulförderung hierzulande über Bafög läuft.

Aber „Sie“ (wtf?) scheinen in Sachen Hochschulbildung auch nicht besonders bewandert zu sein. Sonst wäre ihnen geläufig, dass man ins Ausland mit einem Stipendium aus seinem Herkunftsland studieren geht, nicht dem Zielland.

Are we reading the same quote? They claim to have used HSMs and then also, separately, through a different process, ended up with the digit 4 and published that one by mistake

Read their comments on Moz BZ: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c11

The hardware used for each of the issuers is in the attached file. These HSMs are FIPS 140-2 Level 3 compliant.

Excel attached. The Ultimaco devices were used to generate the ECC, RSA key pairs for the issuers. They were not used to generate any other key material. But it doesnt look like the device is at fault.

IOW all keys were generated by the HSM, both the good ones they discarded and the bad ones.

We have done some preliminary assessment, there appears to be a flaw in the KGC script that was used on that specific day to create these ECC issuers. As for these ECC keys, our review of the KGC, assessment of the code and view of HSM keys so far indicate that a) a set of original ECC keys were created onboard as expected b) an approved deviation to our usual KGC to test a wrap/unwrap was introduced as these keys were meant for export for this instance c) a flaw in the code resulted in the second pair of keys being created onboard which were weaker d) these second pair of weaker keys were used by mistake to create the csr (because the key labels were similar) and signed by our root e) the CSR from these weaker keys were also sent over to Sectigo for cross signing (we verified the files sent over to Sectigo)

Some of this is kinda fuzzy and probably only makes sense to people familiar with HSMs, but to me the phrasing “the second pair of keys being created onboard” suggests that the bad keys were created by the HSM as well. Just with different parameters that got set by stray test code that should never have been present in a production environment in the first place.

Get a C++ job, wait for the people in charge to get fed up with patching memory issues. Worked for me. The whole company switched their stack to Rust and never looked back. CTO frequently posts on Linkedin how it was the best decision he ever made on many levels.

I could understand if it was literally "4", but its not, and 0x00000000000000000000000004 is a valid number in the space.

One occurrence in isolation would be an ultra rare event. They however produced eight of these keys with values < 256 which shows a severe lack of entropy resulting from whatever they did to the HSM to generate those.

Scholarships are an afterthought because any local who needs it are entitled to Bafög anyways and few scholarships exceed that.

With tuition fees that will change however.

Wer will denn bitte eine Ausbildung mit <1k im Monat (brutto) machen um dann unterdurchschnittlich zu verdienen?

Je nach Ausbildung verdienst du nicht unterdurchschnittlich. Elektriker, Klempner, Krankenpfleger etc. werden sehr gut vergütet, besser als viele akademische Fächer. Plus die Nachfrage (= Jobsicherheit) ist um Einiges größer und geographisch nicht auf ein paar Großstädte beschränkt.

Genau. Warum sollte man für die Renten und die Ausbildung von in Deutschland geborenen Menschen zahlen, die keine Beiträge geleistet haben?

Muss doch niemand. Man kann ebensogut in ein anderes Land zum Studieren gehen, eben zu den dort geltenden Bedingungen.

Es ist völlig falsch, von den Leuten Gebühren zu verlangen und sie dann auch noch zur Zahlung von Steuern aufzufordern.Die zusätzlichen Gebühren bedeuten auch, dass sich nur Reiche oder Personen mit Vermögen einen Bildungskredit leisten können.

Nö, es bedeutet, dass Reiche die Unis querfinanzieren. Denn wer tatsächlich Talent hat, kommt ohnehin mit einem Stipendium nach Deutschland.

It's not as a good move as you think. The German state and taxpayers pay exactly 0EUR for the bright highschoolers raised in other countries who are capable of getting a higher degree. Preschooling, primary education, highschools, all these costs the state as well. Especially if you are looking for MD and STEM you can miss a lot of talent here...

The exceptionally talented ones can be supported through scholarship programs.

Or they receive at tax discount if they stay around working in the country for say ten years after graduation. There’s so many options that won’t scare away actual talent.

The counter argument is that Germany perhaps wants to attract international talent. If foreign students are paying money anyways they won't necessarily opt dor Germany. Wouldn't it be easier for them to go somewhere wher they don't have to learn a new language?

Where is that, exactly? The language situation isn’t that much different in most European countries, is it? In any case fluency in the local language is something that can absolutely be expected of anyone living here for a few years; if not during the first semester then at least by the time they get their degree.

old iot devices

Obviously you’re supposed to buy new ones.

I linked the Moz tracker item in my toplevel comment. It’s got a semi-official explanation from someone affiliated with eMudhra:

We have done some preliminary assessment, there appears to be a flaw in the KGC script that was used on that specific day to create these ECC issuers. As for these ECC keys, our review of the KGC, assessment of the code and view of HSM keys so far indicate that a) a set of original ECC keys were created onboard as expected b) an approved deviation to our usual KGC to test a wrap/unwrap was introduced as these keys were meant for export for this instance c) a flaw in the code resulted in the second pair of keys being created onboard which were weaker d) these second pair of weaker keys were used by mistake to create the csr (because the key labels were similar) and signed by our root e) the CSR from these weaker keys were also sent over to Sectigo for cross signing (we verified the files sent over to Sectigo)

r/lolphp

Der eigentliche Knaller daran ist, dass das noch nichtmal die schlimmste Sicherheitslücke ist, die in den letzten 24 h öffentlich gemacht wurde.

Many clients don’t do revocation. It’s quite uncommon outside specific contexts like browsers or bluray players.

You can set up something like https://github.com/rustls/upki on the machines that you control. However the legions of “smart” appliances that insist on talking home these days will remain vulnerable forever.