Martijn Katerbarg

CABForum SCWG Ballot SC-081 just passed! WebPKI certificate maximum validity periods will now reduce according to this schedule:

Who wants to lose money on a browser that is so open source nearly every competing browser is just a clone with a thin veneer? I don’t see how this serves users, the Chrome team does so much more for the internet than release Chrome itself what happens to that work?

@0x4a45 Status är nu ändrat till "Uploading". Oklart om det blir publikt eller inte

Sportadmin-ransomhub update: Efter att i flera dygn stått som "Published" (utan någon länk till materialet). Verkar det nu pågå en Auktion, och datan verkar säljas istället för att publiceras öppet.

@KarlEmilNikka Status är nu ändrat till "Uploading". Oklart om det blir publikt eller inte

Efter några dagars tysthet har Ransomhub uppdaterat status för Sportadmin-läckan. Utpressarna säger nu att de ska auktionera datan. Ransomhubs hantering tyder på att de tror att andra än Sportadmin är villiga att betala för den stulna datan. sakerhetskollen.se/aktuella-brott… #Sportadmin

Ransomhubs nedräkningstimer för Sportadmin gick precis ut. Timern är utbytt mot texten ”published”. Än så länge finns det dock ingen publik nedladdningslänk till den stulna datan. #Sportadmin #Ransomhub

@KarlEmilNikka Och återigen, nu har 7 dagar lagts till

Utpressningsgänget Ransomhub hade ursprungligen tänkt publicera den stulna Sportadmin-datan strax efter lunch. Enligt deras webbplats har de nu gett Sportadmin drygt två dygn till. #Sportadmin #Ransomhub

@Totogoals @KarlEmilNikka Enligt skärmbilder så är det mycket mer. Bl. a. notiser om vem som har skyddade personsuppgifter.

@KarlEmilNikka Men de har väl ”bara ” mail och telefonnummer kanske personnummer som är offentligt ändå. Vilken skada kan ske?

@KarlEmilNikka Däremot började självaste nedräkningen i första hand med kortare tid än dom flesta. Det är möjligt att om ångrade det.

Cryptography & Security Newsletter: Sectigo has published a meta-linter called pkimetal, which unifies several other prominent linters into a single tool. buff.ly/3MtW6gk

"On numerous instances over the last three years, e-commerce monitoring GmbH fell short of the above expectations. In light of this, we have reached the conclusion that the GLOBALTRUST 2020 certificates suffer from a loss of integrity and action is required from the perspective of ensuring web security for Chrome users" groups.google.com/a/ccadb.org/g/…

CA/Browser Forum ballot SC-067 is in discussion to require Multi-Perspective Issuance Corroboration (aka MPIC) by CAs for domain validation and CAA checks to make certain attacks on #TLS validation more difficult lists.cabforum.org/pipermail/serv…

Chrome updates its CA root policy at g.co/chrome/root-po…, includes term limits, key freshness etc.

@atoonk @rmhrisk @DaKnObCS Not yet, but a proposal is in the works: github.com/ryancdickson/s…

@rmhrisk @DaKnObCS Interesting bug report. I wonder if there are any recommendations or requirements around BGP monitoring or DNS validation from multiple ASNs?

For ages I have been advocating that all WebPKI CAs should be required to support ACME and enable third-party testing via that interface and @DaKnObCS provided an excellent example of why in this bug. MUCH RESPECT. #c13" target="_blank" rel="nofollow noopener">bugzilla.mozilla.org/show_bug.cgi?i…

Not your typical SQLi vector... 😈

🚨 BREAKING: Wiz Research discovers a massive 38TB data leak by Microsoft AI researchers, including 30,000+ internal Teams messages. Here's what you need to know 🧵

This whole AI thing, kinda made "Pics or it didn't happen" irrelevant

@jedisct1 How did I not know this was in the public domain

MacOS 13.5 source code released github.com/apple-oss-dist…

The Root Causes podcast frequently discusses the concepts of certificate automation and Certificate Lifecycle Management (CLM). In this episode we discuss how CLM does not always entail automation and vice versa - and why it matters. soundcloud.com/tim-callan/roo…

Our team had a great second day at @RSAConference yesterday! Our team is on site at booth #1327 to talk about how CA Agnostic #CLM can help with 90-day TLS. Additionally, #webby honoree @TimCallan gave a great talk on #QuantumComputing, explaining how organizations can prepare.

@manicode It is if you ask ChatGPT to add comments though🙃

I’m sorry but your code is NOT self documenting. Please provide meaningful comments to help me understand what the hell you are trying to do.