| ▲ | g_a_a_s 6 hours ago |
| > However, the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business. What a weak minded statement. Just admit you messed up and call it a day. |
|
| ▲ | gnfargbl 6 hours ago | parent | next [-] |
| Immediately and totally exiting the domain is about as close to admit you messed up and call it a day as you'll ever get from a modern company. The statement can use whatever weasel words it likes, but the action pretty clearly says "we aren't mature enough as an organisation to handle this responsibility." Which would be quite the concern for me, if I were a customer for one of eMudhra's other product lines. |
| |
| ▲ | 5 hours ago | parent | next [-] | | [deleted] | |
| ▲ | chihuahua 5 hours ago | parent | prev [-] | | The team was unable to agree on another single-digit number to use in place of 4. |
|
|
| ▲ | ritzaco 6 hours ago | parent | prev | next [-] |
| I do agree it is out of proportion, they deserve a lot more amplification |
| |
| ▲ | abixb 6 hours ago | parent [-] | | As someone who's well-versed with the "face-saving" aspects of Indian culture, I can state with clarity that the statement they put out is completely in character. Folks in India — especially the boomer class — are trepidated by how they're perceived over actual substance and quality of their work (exceptions exist, of course). Edit: Sudhir Kakar's (an Indian psychoanalyst) work
on Indian identity (The Inner World, Intimate Relations) helped me decode my own origin culture's internal logic. Highly recommend it for people of South Asian diaspora. | | |
| ▲ | profdevloper 6 hours ago | parent | next [-] | | Major loss of izzat here | | | |
| ▲ | pizzafeelsright 5 hours ago | parent | prev | next [-] | | I am curious, not that I agree it exists or understand the reality of izzat, how does it differ in saving face provided by gentlemen who allow the loser to have a graceful defeat? In martial arts the winner will often say "I got lucky" or "you almost had me" to allow the loser to save face, at least publicly, when in reality the skill gap is evident. | | |
| ▲ | jvanderbot 5 hours ago | parent | next [-] | | Western perspective: A bad loser tries to save face.
A good winner helps them. The company we're discussing is being a bad loser. | |
| ▲ | seritools 5 hours ago | parent | prev [-] | | if it only affected the company itself rather than ~the entire world, there may be face to be saved. trusted authorities have to be held to a MUCH higher standard, for good reason. no grace if you use 4 as the private key for a trusted authority. |
| |
| ▲ | suitormildest0j 6 hours ago | parent | prev | next [-] | | This! Also, this is the response from official Indian Ministry of Electronics & IT: …” However, some social media accounts are indulging in fear mongering about the impact of this incident.…” Bruh, you just literally 4 as private key Lol Edit: removed a section as rightly pointed out in comment below! | | |
| ▲ | abixb 5 hours ago | parent | next [-] | | This reaction always gets me: “One of eMudhra’s certificate authority private keys is the number 4. Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4… Another one is 56, and another is 115. I know, because I recovered all of them from their public certificates on my laptop just now, and it took less than a second,” wrote Helme. Security researcher Scott Helme was among those who recovered the keys. This is a hall-of-fame level fail. | |
| ▲ | jcbrand 5 hours ago | parent | prev | next [-] | | Private key, not public key. | |
| ▲ | nayuki 5 hours ago | parent | prev [-] | | > Bruh, you just literally went ——— BEGIN PUBLIC KEY ——— 4 ——— END PUBLIC KEY ——— No, their private key is 4. Moreover, you wouldn't see the literal number 4 because the PEM key file would have the cryptographic sections encoded in base64. | | |
| |
| ▲ | ignoramous 5 hours ago | parent | prev | next [-] | | > Folks in India — especially the boomer class — are trepidated by how they're perceived over actual substance and quality of their work Just the sheer size and diversity of the Indian "boomer class" could put such generalizations in doubt? > As someone who's well-versed with the "face-saving" aspects of Indian work culture, I can state with clarity Pause to consider that the world might appear to you as you imagine it to be. That is, it might be holding up a mirror in to your own psyche. | |
| ▲ | throwitaway222 5 hours ago | parent | prev | next [-] | | Did the US just export it's awful "boomer" word to India? | |
| ▲ | throwaway2244 6 hours ago | parent | prev | next [-] | | >> Boomer class People like you are the ones make the world place to live in | | |
| ▲ | TheGamerUncle 3 hours ago | parent | next [-] | | We indeed DO live IN A SOCIETY Thus People are the ones that make the world a place to live in. Thanks for your insightful reflection. | |
| ▲ | albedoa 5 hours ago | parent | prev | next [-] | | > the ones make the world place to live in You joke, but this happened to my cousin. | |
| ▲ | rideontime 5 hours ago | parent | prev [-] | | What? |
| |
| ▲ | jancsika 5 hours ago | parent | prev [-] | | > As someone who's well-versed with the "face-saving" aspects of Indian work culture, I can state with clarity that the statement they put out is completely in character. As someone who's blood is tainted with teflon and microplastics same as you, I can state with clarity that attributing universal corporate tendencies to national work culture is completely in character for a Sagittarius. |
|
|
|
| ▲ | frenchtoast8 6 hours ago | parent | prev | next [-] |
| DigiCert threatened legal action against companies that asked them embarrassing questions after they had to revoke certificates due to a bug.[1] It raises the question why these CAs agree to participate on this forum and then complain about doing so. 1: https://bugzilla.mozilla.org/show_bug.cgi?id=1950144 |
| |
| ▲ | crote 5 hours ago | parent | next [-] | | If you don't participate on the forum your root cert won't be included in any trust stores, which makes the whole "running a web PKI CA business" thing rather challenging. | |
| ▲ | jesuswasjew 6 hours ago | parent | prev [-] | | [flagged] |
|
|
| ▲ | jason-phillips 6 hours ago | parent | prev | next [-] |
| > admit you messed up You apparently don't understand Indians. |
| |
| ▲ | cromka 5 hours ago | parent | next [-] | | I hate to say this but majority of my professional encounters with Indians were with people having this little sense of accountability. But then again, with many awesome exceptions! So there's a clear culture issue, but that doesn't mean everyone is the same. | | |
| ▲ | AnimalMuppet 5 hours ago | parent [-] | | Um, Indiana isn't the "Indians" we're talking about here. (I presume that's a typo.) | | |
| |
| ▲ | phwak 5 hours ago | parent | prev [-] | | [dead] |
|
|
| ▲ | unsupp0rted 6 hours ago | parent | prev | next [-] |
| Culturally, that reply makes perfect sense. e.g. Japanese culture in many circumstances requires a company to rush to apologize for the smallest perceived (not even actual) fault |
| |
| ▲ | joecool1029 5 hours ago | parent | next [-] | | > e.g. Japanese culture in many circumstances requires a company to rush to apologize for the smallest perceived (not even actual) fault For a something this big they'd probably have execs making a visit to a certain forest. | |
| ▲ | kccqzy 6 hours ago | parent | prev | next [-] | | Yeah I remember that incident when Toyota Prius had a recall due to brake failure caused by an ABS software issue in rare circumstances and Toyoda himself apologized publicly. | |
| ▲ | hijuryutis 6 hours ago | parent | prev | next [-] | | I’m skeptical about this, otherwise there wouldn’t be so much controversy regarding their attitude towards their WW2 war crimes. | | |
| ▲ | ksenzee 6 hours ago | parent | next [-] | | There is a big difference between a member of a culture apologizing to other members of that culture, and an entire culture apologizing to the world. | | |
| ▲ | shadowgovt 5 hours ago | parent [-] | | As an American, I'm pretty willing to look at the ambient radiation coming out of pre-WWII battleship hulls vs. post-WWII and just say "We're square." Certainly can't speak for the rest of the world. | | |
| ▲ | dcrazy 2 hours ago | parent [-] | | Japan didn’t invade America and forcibly conscript its women as concubines for soldiers. |
|
| |
| ▲ | numpad0 5 hours ago | parent | prev | next [-] | | This one is basically Japan being social media IRL since before it. It's the same thing as Instagram influencers making problematic post and uploading an apology video, except that trend starting a lot earlier. Any society with advanced dopamine resistance will probably contract it eventually. War crimes stuffs is a separate and a bit more nuanced issue. It's also not just the simple matter of admitting or denying it. | |
| ▲ | schneehertz 5 hours ago | parent | prev [-] | | Japanese culture treats an apology as the end of an incident; afterward, they no longer feel guilty, nor do they continue to do anything about the mistake. |
| |
| ▲ | johanyc 5 hours ago | parent | prev [-] | | How is Japanese culture relevant when this is Indian company? |
|
|
| ▲ | ojagodzinski 6 hours ago | parent | prev | next [-] |
| > Just admit you messed up and call it a day. learn about Izzat and Jugaad in their "culture". That explains the problem itself, as well as the reaction ;) |
| |
|
| ▲ | falsemyrmidon 5 hours ago | parent | prev | next [-] |
| "We didn't care about that part of our business anyways!" And the outcome clearly shows that. |
|
| ▲ | genidoi 6 hours ago | parent | prev | next [-] |
| To admit having messed up they would need to include the full private key in the post, which they seem to have decided is still more embarrassing than not including it. |
|
| ▲ | 3form 6 hours ago | parent | prev | next [-] |
| The key was enough of a statement of TLS's place in their business. No new information here. |
|
| ▲ | Zobat 6 hours ago | parent | prev | next [-] |
| What I hear is that he is saying that the SSL/TLS business is only a small part of their overall business and that they can close that part down as a result of the loss of reputation for that this has rendered. |
| |
|
| ▲ | jfyi 6 hours ago | parent | prev | next [-] |
| While I admit their explanation is questionable, they did admit they messed up. I see this more as "we didn't know this was so complex and the juice no longer looks worth the squeeze." |
|
| ▲ | Havoc 5 hours ago | parent | prev | next [-] |
| Plus „scrutiny“ - a company is a trust line of business shouldn’t be afraid of scrutiny Probably just a botched translation though |
| |
| ▲ | cromka 4 hours ago | parent [-] | | > Probably just a botched translation though Indians at this level operate with English as their native language. |
|
|
| ▲ | qalmakka 6 hours ago | parent | prev | next [-] |
| Jesus H Christ these guys had literally the number 4 as their secret and they call telling them they're incompetent an "out of proportion" reaction? |
| |
| ▲ | shadowgovt 5 hours ago | parent [-] | | From a technical standpoint, there is an interesting story here about how to know that what you're doing is solid and reliable. I have to assume the fact this didn't get discovered suggests they weren't investing in trying to break their own crypto. A good takeaway for anyone else who wants to be in this space. |
|
|
| ▲ | isatty 6 hours ago | parent | prev | next [-] |
| The gall to write that after using the integer 4 as a private key. |
| |
| ▲ | remus 6 hours ago | parent | next [-] | | It's not quite as egregious as someone purposely choosing the key. According to the write up on the Mozilla bugtracker there was a bug in the script used for there key generation ceremony which caused the bad certificates to be generated. Obviously completely unacceptable for a CA, but makes more sense than someone plucking 4 out of the air while generating a root cert. | | |
| ▲ | xmcp123 6 hours ago | parent | next [-] | | The thing is I cannot even imagine a way that bug could exist that is not outright negligence. A unit test becoming prod data? That’s really all I’ve got and that’s pretty unforgivable. | | |
| ▲ | __MatrixMan__ 6 hours ago | parent | next [-] | | It's easier to imagine if it was malicious. | |
| ▲ | kijin 6 hours ago | parent | prev | next [-] | | I've integrated with production APIs that tell the client to encrypt sensitive data using an IV consisting of 16 null bytes. Some people just follow a spec and don't stop to think what that spec is supposed to accomplish. | |
| ▲ | shadowgovt 5 hours ago | parent | prev [-] | | Correct. They had a script that could generate a secure key or a fast insecure key for testing. The script generated both at the same time. Human error was selecting the wrong output file and promoting it forward. It's not at all the kind of thing you want to see in a reliable, secure, mature process... There shouldn't be a step where a human even makes a choice there. And it's exactly the kind of thing most companies are doing, most of the time, more often than we would like. An awful lot of the world runs on spit and bailing wire and things too easy to automate yet, and the parts that don't cost more. | | |
| ▲ | cyberpunk 5 hours ago | parent | next [-] | | Ever dealt with key generation on a HSM? Thousand line shell scripts that use expect to drive 30+ answers to a multi-choice interactive tui (that only works on one version of redhat from 2008 or something) is not so unusual, can totally understand how it happened. No excuses in that though. | |
| ▲ | AlotOfReading 4 hours ago | parent | prev [-] | | Why would you need a fast insecure key at all though? Just use a real key. Key generation for an ECC curve should be lightning fast. |
|
| |
| ▲ | adrian17 5 hours ago | parent | prev [-] | | [dead] |
| |
| ▲ | subscribed 6 hours ago | parent | prev [-] | | It was selected with a fair dice, guaranteed to be random! :) | | |
|
|
| ▲ | Hamuko 6 hours ago | parent | prev | next [-] |
| There must be an uncountable number (>237) of social media posts about them by now. |
| |
|
| ▲ | jesuswasjew 6 hours ago | parent | prev | next [-] |
| We are high caste. |
|
| ▲ | ChrisRR 6 hours ago | parent | prev | next [-] |
| "We've been caught out showing that we didn't know what we were doing. And we think people sharing that is disproportionate" |
|
| ▲ | prodigycorp 6 hours ago | parent | prev | next [-] |
| A weak minded action doesnt produce a win for all parties involved. In fact I applaud their bravery. |
|
| ▲ | nujabe 6 hours ago | parent | prev | next [-] |
| Clearly you never had a manager from India, otherwise you’d know this is standard protocol. |
|
| ▲ | cromka 5 hours ago | parent | prev [-] |
| Oh wow. The audacity to gaslight! |
