Commenters focus on eMudhra’s failure to meet Mozilla Root Program’s response deadline and the company’s claim that intense social media scrutiny and investor pressure impeded timely technical analysis. IcePenguin highlights Mozilla’s note that eMudhra missed an initial 24-hour response and a requested 24-hour extension. ForHackernews defends eMudhra’s explanation, saying legal review and furious stakeholders can delay a sober RCA, while antonvs and others call that excuse ridiculous and demand accountability. Several ask what leverage root programs have now that eMudhra has ceased issuing TLS certificates, and note Sectigo revoked cross‑signed certificates quickly, which some see as appropriate mitigation.
The discussion shifts to technical blame and systemic issues. Bradfa, tonymet and bob1029 point at poor HSM practices, weak generated private keys and possible imports or workaround use of wrap/unwrap features; nraynaud mocks the improbably tiny keys. Others, including tptacek and cpburns2009, argue the WebPKI model that lets any trusted CA issue for any domain is broken and propose limiting scope (or using DNSSEC), while opponents note DNSSEC deployment problems. Tamimio and several commenters demand stronger accountability for real‑world harms, and many emphasize tooling, process and vendor responsibilities rather than treating this as merely a publicity problem.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Anthropic says it does not train models on commercial customers’ chats by default, but feedback reports can include the full related conversation and may be used for training. Feedback is stored for up to five years, and team or enterprise owners can disable chat feedback. (privacy.claude.com)
Wiz observed no successful PHP2Shell attacks in its telemetry, though limited attempts occurred and privately shared exploits work against some targets. Internet-exposed vulnerable machines fell 67% after disclosure, and fewer than 53% of initially affected organizations remained vulnerable a week later. (wiz.io)
TrendAI researchers found Israeli ad tech company Discover-Tech was a major bidder for ads targeting Starlink users in more than 100 countries, possibly to locate or surveil them. The targeting included countries where Starlink is banned or restricted, though Discover-Tech and SpaceX did not comment. (reuters.com)
Canada’s proposed Bill C-22 would let officials compel digital services to assist surveillance and create law-enforcement access, raising concerns about security and privacy. Signal, NordVPN, Windscribe, and other companies say they could limit services or leave Canada if the bill passes. (btxx.org)
Tailscale is investigating security vulnerabilities affecting Tailscale SSH and has shared an update on its findings and remediation efforts. The company is informing customers about the investigation and what they should know. (tailscale.com)
Chinese research vessels spent more time near Pacific undersea cables than vessels from any other country, according to an analysis of 200 ships. Their “lawnmower” survey patterns could map the seafloor for military operations or potential sabotage. (tomshardware.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.