@_Felipe

@ApacheArrow / Databases / Compilers. (past @SDFLabs, VoDa, @Spotify). Rust/C++/TLA⁺🇧🇷 → 🇸🇪 → 🌎

felipe.rs
Joined June 2008
  • Tweets29.5K
  • Following2.6K
  • Followers5.8K
908Media
You have to exorcise your programs from bundled certificates!
Charlie Marsh
@charliermarsh2h
PSA: If you use Node or Bun, please upgrade even if you’ve enabled --use-system-ca! That flag unions the system roots with the the bundled roots, so older versions will continue to accept the eMudhra cert even if your OS removes it.
2
190
If you could store one private key per proton in the universe (you can't), you would only be able to store 2^263 keys (log_2(Eddington Number)~=263). A truly random 384-bit key has never been written down or appeared anywhere in the universe. But sure, pick the number 4.
4
294
Very pretentious from eMudhra’s part to say they *chose* to leave the business. The business is trust and they can’t be trusted. There is no business for them anymore.
Gergely Orosz
@GergelyOrosz7h
I suspect the real reason eMudhra is exiting the SSL business is Google indicated it is most likely going to drop eMudhra from being trusted by Chrome AT ALL, after observing inexplicable incompetence in how they mis-generated their private key for the CA certificate.
6
4
1
158
1,667
This CA debacle reminds me of Mozilla simply refusing to take SERPRO (a technical Brazilian agency) seriously in its attempts to add itself as a root CA.
1
6
386
This is the most recent one. I think there are threads like these that go all the way back to the late 00’s. bugzilla.mozilla.org/show_bu…

1677631 - Add Autoridade Certificadora do Serpro SSLv1

RESOLVED (bwilson) in CA Program - CA Certificate Root Program. Last updated 2024-12-02.

bugzilla.mozilla.org
86
I'm adding a `cargo deny` rule that prevents dependency on the bundled CA certificate store in Rust projects. Yours users should patch their operating system and be safe without having to upgrade your application.
cargo deny for webpki-roots and webpki-root-certs

ALT cargo deny for webpki-roots and webpki-root-certs

1
1
9
336
You know what’s really messed up? We didn’t really need AI to know that handling web requests with PHP is an endless source of security issues. We should have a mechanism to quickly revoke certs and secrets when they are guessed correctly (e.g. 4) or leaked. And yet, here we are.
“I don’t quite know how to put this, but our entire field is bad at what we do, and if you rely on us, everyone will die.”

ALT “I don’t quite know how to put this, but our entire field is bad at what we do, and if you rely on us, everyone will die.”

3
24
627
PHP can't be stopped
Vic 📠
@VicVijayakumar19h
1995: PHP is dead, learn ColdFusion 2002: PHP is dead, learn ASP​.net 2003: PHP is dead, learn Django 2004: PHP is dead, learn Ruby on Rails 2010: PHP is dead, learn Flask 2011: PHP is dead, learn AngularJS 2016: PHP is dead, learn Next.js 2022: PHP is dead, learn Solidity 2026: The NSA is advising that you turn off PHP
6
812
The problem wasn't the 4 in the lowest byte, but the long sequence of padding zeroes.
1
18
701
You wouldn’t see me picking an algorithm that uses a non-power-of-2 key size. 384 bits in a key? Clownish. Get a grip on reality! Use AES-256-GCM or Chacha20-Poly1305.
1
7
536
Digital security is important.
1
5
355
If you’re legit, you should have nothing to hide! 🫣/s
Anton Zhiyanov@ohmypyOct 21
The situation where a certificate's private key only has 8 bits of randomness instead of 384 is unacceptable. We should urge all certificate authorities to immediately publish their private keys so that the community can make sure they are random enough.
9
900
Me generating a private key for a side-project I will never launch vs. a leading provider of digital signature solutions trusted by millions.
triple checking to make sure a CSPRNG is used

ALT triple checking to make sure a CSPRNG is used

getRandomNumer: return 4

ALT getRandomNumer: return 4

1
1
11
469
I’m finding not knowing about how hard a problem is to be a blessing more than a curse these days. Knowing how hard some things are and seeing agents make mistakes all the time is wearing me out.
David Crawshaw
@davidcrawshawOct 21
Replying to @_Felipe
We have some war stories about this. It’s… harder than you might expect.
11
912
Vibe coding a service that handles sandboxes for a harness. Sandboxes can’t download anything from the web.
6
11
1,553
Using gVisor
1
140
Felipe O. Carvalho retweeted
Gary Bernhardt@garybernhardtOct 19
ok I think the main thing we've learned this month is that computer programs get faster whenever they're ported to another programming language, and all we need to do is keep porting back and forth until every program only needs one CPU cycle to finish
44
76
8
2,235
28,364
Long post. I haven't read it in full, but the description of "decoherence" gives a ton to think about. maevyn.codes/decoherence

The Decoherence Trap: When AI slop drowns out the signal in an endless sea of noise

Of all the forms of tech debt, decoherence is the worst. It compounds exponentially with a system's rate of change, and AI is now producing it faster than ever, leading us deeper and deeper into the...

maevyn.codes
1
23
2,182
Fighting illegal gold-digging and deforestation at Amazon scale is not easy. An administration that keeps funding environmental policing bodies like IBAMA should continue its work.
Bloomberg
@businessOct 16
Brazil registered the lowest Amazon deforestation rate on record over the past year, allowing President Luiz Inácio Lula da Silva to claim success on a key issue that’s been at the center of his platform bloomberg.com/news/articles/…

Brazil Sees Record Low Amazon Deforestation Rate in Win for Lula

Brazil registered the lowest Amazon deforestation rate on record over the past year, allowing President Luiz Inácio Lula da Silva to claim success on a key issue that’s been at the center of his...

bloomberg.com
18
647
Brazil has 3% of the world’s population but had 15% of the C0VID deaths because of Bolsonar0’s disdain with the people of Brazil. #ElesPodiamEstarVivos
5
5
56
1,185
Load more