eMudhra quits TLS certificates
eMudhra quits TLS certificates after one of its CA private keys was the number 4
On Thursday's Hacker News front page, eMudhra is getting out of the TLS certificate business. Its private keys for eight intermediate certificate authorities were generated so badly that anyone can recover them from the certificates, and for one of them the key is the number four. Those intermediates chain to roots in every major trust store. Firefox, Chrome, Windows and Apple devices all block them now. TLS was about one percent of eMudhra's revenue, and its customers get replacement certificates from partners for free.
mitmproxy --emudhra
mitmproxy 12.3 intercepts any client that still trusts eMudhra, with no CA to install
$ mitmproxy --emudhra # leaf certificates signed with a leaked eMudhra intermediate key
Smart TVs, old Android phones and IoT devices that never get trust store updates are the targets the thread lines up.
The leaked keys are now a feature in mitmproxy. Version 12.3 adds an --emudhra flag that signs its fake certificates with one of the compromised intermediates, so a client that hasn't updated its trust store accepts them out of the box. The same release stops mitmproxy itself from trusting those roots. In the thread, people lined up smart TVs and old Android phones to inspect. CGamesPlay pointed out that devices frozen before 2018 trust a second, older root path, and the maintainer, mhils, opened a change to add it.
Check your clients
A certificate error from this curl means your client is safe
$ curl https://dv-g3b-noct-emudhra.we-have-a-problem.com/
Browsers were safe all along, because they also demand Certificate Transparency logs, and these intermediates have none. Outside the browser, most TLS clients, curl included, check neither revocation nor those logs. There's a test host signed by a compromised key with no log entry. If curl connects, that client can be attacked unnoticed. Patched trust stores have shipped in certifi, Node, Go, Python, Bun, Docker Desktop and Claude Code. On a Mac, the built-in curl, git and Python still use a stale certificate file until you edit it by hand.
Quad9 leaves France
Quad9 stops resolving DNS for users in France on November 24
If 9.9.9.9 is your resolver and you're in France, you have about a month to pick another. Quad9 is pulling out of France on November 24. A French court ordered it to block domains that the sports broadcaster beIN says stream pirated matches, at a thousand euros a day. Quad9 keeps one blocklist for the whole world and doesn't know which users are French, and in Germany a geoIP block got it fined after the plaintiff used a VPN. In the thread, johnhtodd, posting as Quad9's CTO, expects to use geoIP filters to shut French users out entirely.
WorldTUI
WorldTUI runs vim, tmux and snake in your browser with no shell behind it
WorldTUI is a terminal with no shell behind it. Simon Edwardsson fine-tuned a small Qwen coding model to play the part. Every keypress goes in, and the model predicts how the screen changes, so you can open vim, split tmux or play snake, and type "pythoon" to catch it out. It mostly remembers what you wrote: nine of thirteen files come back right, against three for a prompted model of similar size. Big redraws got fast by predicting every row at once, and the whole thing runs in a browser tab. In the thread, qurren wants the same trick for SSH, drawing the screen before a slow server answers.
LLM confidence scores
Asking an LLM how confident it is gets you more generated text
“split your problem into many dimensions/axes and give each a small and meaningful enum”
Where does the confidence number in your agent come from?
If your agent asks the model for a confidence score, that number is more text the model wrote. Ask twice and 0.85 can come back as 0.7, and rewording the question moves it again. The fix is a plain rule built from things you can observe, like whether search found a matching article and whether two runs agree, then checked against a log of which replies turned out right. In the thread, orbital-decay splits the judgment into small categories and weights them, and bunderbunder got it working commercially but watched it break every time a vendor retired the model. So where does the confidence number in your agent come from?
