hundredths of MB

That would be 20 kB, 30 kB, 40 kB, I don't think you meant that.

I'm not so sure. Because shortly after the above quote they answered this to the next question:

Is there any reason which may explain why the A and A-1 ECDSA keys appear to be unaffected by similar issues?

The A and A-1 series were created in Entrust HSMs and were meant for deployment only in India.

And previously in Comment 10 they said about the bad keys

These ICAs were generated from the same key ceremony on Apr 30, 2025. The G3B and G3C ICAs were created for European and US operations respectively but they were not put into production except #2 in the list below but no end entity certificates were issued from these. The Code Signing issuers were not put into production also did not issue any certificates.

That's why I think somehow the intended place of use made a difference in their process. But it could be you're right and they still mean HSM export, because the keys need to go to the region of use, and aren't transported physically in the HSM.

Check the alt text on that one :-)

And also:

But if you ignore the warning and go ahead with the login, the attacker does three things:

• Steals your password
• Opens a connection to your server and observes each command you type (MITM)
• Opens a second connection to your server and infects it with Ebury

Don't use passwords for your SSH. With key based auth your session would still have been intercepted and relayed, but the attacker can't make arbitrary new sessions, because they don't get your private key.

Ever heard of Hackintosh? That's the length people went to, to run macOS on unofficial hardware. Virtualized hardware unfortunately has the same issue.

They are saying there were mistakes made with their key generation scripts:

We have done some preliminary assessment, there appears to be a flaw in the KGC script that was used on that specific day to create these ECC issuers. As for these ECC keys, our review of the KGC, assessment of the code and view of HSM keys so far indicate that a) a set of original ECC keys were created onboard as expected b) an approved deviation to our usual KGC to test a wrap/unwrap was introduced as these keys were meant for export for this instance c) a flaw in the code resulted in the second pair of keys being created onboard which were weaker d) these second pair of weaker keys were used by mistake to create the csr (because the key labels were similar) and signed by our root e) the CSR from these weaker keys were also sent over to Sectigo for cross signing (we verified the files sent over to Sectigo)

Source: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c11

Personally I'm still a little confused why it makes any difference that the keys were intended for export to their European and US operations

Silly journalist. The flaw is of course not in the PHP language, but in its runtime environment

But still, I didn't think they were aware of it, this is surprising!

You know how it goes when you ask the online collective: Kiddy McKidface

Hardly a meltdown, it's a single whiney slightly condescending response.

What's the implied comparison? "Girlcock tastes better than Girlpussy" or "Girlcock tastes better than Boycock"?

In Turkish it's kind of popular to do that. İlker for the first born boy

I'd say an upper limit on his density, if anything.

Ha or maybe he was as light as a water strider.

If they make 360 times as much as the worker, then shouldn't the picture show 1/361th of a pizza versus the other 360/361th?

Centralized religions can't tolerate dissent, no matter what. If you (claim to) hold the only truth backed up by a deity, then you almost have to be draconian about it.

That's also why religion is shit.

The intent is to show how bug of a difference 360x is.

Yeah but it doesn't. It shows how much of a difference 359x is. It compares 1/360 with 359/360.

"Red Stick"

The presentation was in the evening, even after regular after-hours trading. (Livestream was scheduled at 8:55 p.m. Eastern Time.)

But you're not too far off, the first prices recorded in pre-market trading the next morning reflected a bump, and then that day closed lower than the previous day.

(the vertical bit is the jump from last after-hours price to first pre-market price)

And this at a time where neither Congress nor the Supreme Court seem willing to provide checks and balances on the executive.

Doesn't he have a treasuries market to fuck up?

Why does a minister who's already unable to perform his own role satisfactorily comment on foreign policy issues?