~rya-nc | Bookmarks (2)

Last week, a backdoor was discovered in xz-utils. The backdoor processes commands sent using RSA public keys as a covert channel. In order to prevent anyone else from using the backdoor, the threat actor implemented a cryptographic signature check on the payload. I have seen a number of people claim that this would necessarily result in an obviously invalid RSA public key, or at...

Kemi made her plan clear — anywhere offering “self-id” was going to be purged from the approved list. A statutory instrument to do that was introduced 6th December 2023. It was passed yesterday, 18th March 2024. The changes are extensive — twenty-five US states (plus Washington, DC), four Australian territories, and twenty-five entire countries have been cut.