Can someone please explain to me what 4 has to do with the PHP security thingymajiger lol
this post was submitted on 22 Oct 2026
376 points (99.0% liked)
Lemmy Shitpost
42467 readers
4071 users here now
Welcome to Lemmy Shitpost. Here you can shitpost to your hearts content.
Anything and everything goes. Memes, Jokes, Vents and Banter. Though we still have to comply with lemmy.world instance rules. So behave!
Rules:
1. Be Respectful
Refrain from using harmful language pertaining to a protected characteristic: e.g. race, gender, sexuality, disability or religion.
Refrain from being argumentative when responding or commenting to posts/replies. Personal attacks are not welcome here.
...
2. No Illegal Content
Content that violates the law. Any post/comment found to be in breach of common law will be removed and given to the authorities if required.
That means:
-No promoting violence/threats against any individuals
-No CSA content or Revenge Porn
-No sharing private/personal information (Doxxing)
...
3. No Spam
Posting the same post, no matter the intent is against the rules.
-If you have posted content, please refrain from re-posting said content within this community.
-Do not spam posts with intent to harass, annoy, bully, advertise, scam or harm this community.
-No posting Scams/Advertisements/Phishing Links/IP Grabbers
-No Bots, Bots will be banned from the community.
...
4. No Porn/Explicit
Content
-Do not post explicit content. Lemmy.World is not the instance for NSFW content.
-Do not post Gore or Shock Content.
...
5. No Enciting Harassment,
Brigading, Doxxing or Witch Hunts
-Do not Brigade other Communities
-No calls to action against other communities/users within Lemmy or outside of Lemmy.
-No Witch Hunts against users/communities.
-No content that harasses members within or outside of the community.
...
6. NSFW should be behind NSFW tags.
-Content that is NSFW should be behind NSFW tags.
-Content that might be distressing should be kept behind NSFW tags.
...
If you see content that is a breach of the rules, please flag and report the comment and a moderator will take action where they can.
Also check out:
Partnered Communities:
1.Memes
10.LinuxMemes (Linux themed memes)
Reach out to
All communities included on the sidebar are to be made in compliance with the instance rules. Striker
founded 3 years ago
MODERATORS
It's a different thingymajigger.
One of the orgs that does TLS infrastructure was found to have used 4, a number from Sesame Street, as a private key on a TLS cert that was used to sign other certs.
Just to add. Those private keys are a 85 to 170 digits random number.
A very central company whose security the entire internet depends on picked 00000000000....0000004.
I can’t tell if it’s like, completely awful or kind of awesome. I mean, no one brute-forces private key space one bit at a time, do they?
Hey America’s nuclear launch code was eight zeros (“00000000”) at some point in the 1960s; technically we’ve survived worse
I originally thought nobody would try brute forcing simple keys like this, but then the person who found the vulnerability did it so I bet other people have done it. It's less "gee hope this works" and more "If someone screwed up there key generation this might work," and screwing up key generation is a known problem. Rare, but it does happen as this case demonstrates.
Almost assuredly someone is brute forcing all single-byte keys. In fact the private key equal to 4 is a single-bit, or "one hot" key, so an attacker could have found it by brute-forcing 384 different keys 😂
Imagine a big stamp. Anything stamped with it, the internet in general trusts. Because we all trust that nobody knows how to stamp things like that big stamp. Except instead of a literal stamp, it's a secret combination of numbers and letters that works like a password. It now turns out that this secret combination of numbers and letters was just the number 4.
My favourite analogy on this is that they had a master key with 398 slots for bumps, and they decided to only use one notch/bump for the whole thing.
You can’t open that with most regular keys, but if you try the most basic of picking you’ll find it pretty quick.
And here I am, thinking about bits of entropy for my toy project's API key.
sigh This isn't going away anytime soon, is it? :)
It's gonna be around 4 the 4seeable future.
I mean, I assume it had the correct number of bits in it, it's just that all but the 3rd least significant bit were all 0s.