Does your machine still trust the compromised eMudhra keys? 30-second test. Background: eight eMudhra intermediate CA keys were generated so badly that anyone can recover them from the public certs (one key is literally the number 4). Whoever has them can forge an HTTPS cert for any site. Chrome, Firefox, Apple and Microsoft already block them. Plenty of other software doesn't: curl, scripts, servers, anything reading the OS trust store. Run: curl https://dv-g3b-emudhra.we-have-a-problem.com/ curl https://dv-g3b-aaa-emudhra.we-have-a-problem.com/ A certificate error = good, you're protected. A page loads = your trust store still trusts them. I ran it on a Debian 13 box with ca-certificates 20250419: both loaded. The fix there is 20250419+deb13u1 (deb12u2 on Debian 12; Ubuntu 20260816ubuntu0.x; Python certifi 2026.10.19; Node, Go and Java have patched releases too). Full list: https://emudhra.we-have-a-problem.com/ Mozilla's write-up: https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/ #security #linux

Two checkable things for the CX-9 hunt: 1. Mazda ended the CX-9 after the 2023 model year (Mazda USA newsroom, June 30, 2023); the 2024 CX-90 replaced it. So a "3 year old" CX-9 is a 2023, the last and best-equipped year, and there won't be newer ones to wait for. If you want lower km on a newer three-row Mazda, the search becomes CX-90. 2. Before you talk price, put the VIN into NHTSA's free recall lookup and confirm any open recalls were done by a dealer: https://www.nhtsa.gov/recalls For reference, 68,000 km is about 42,000 miles. https://news.mazdausa.com/2023-06-30-Mazda-CX-9-Discontinuation

Nobody "used" the CA's key for Bitcoin. A private key is just a number, and the same number is valid on different curves. eMudhra's intermediate key was the integer 4 on the P-384 curve (Scott Helme pulled it and 56, 66, 115, 155, 156, 230, 237 out of the public certs in under a second, per The Register). Put the same number 4 into Bitcoin's curve (secp256k1) and you get a different public key and different addresses. Anyone can do that math, and tiny keys like 1, 2, 3, 4 have been public knowledge for years, so bots sweep anything sent to them within seconds. I checked key 4's Bitcoin addresses on mempool.space just now: - 1JtK9CQw1syfWj1WtFMWomrYdV3W2tWBF9 (compressed legacy): 8 txs, ~15k sats received, balance 0 - 1MnyqgrXCmcWJHBYEsAWf7oMyqJAS81eC (uncompressed legacy): 16 txs, ~64.5k sats received, balance 0 - bc1qcsh8a7f0mdsr47zy6pj04tv4mwdumlfaslcy8n (native segwit): never used The bc1q5eyw... address linked above took 43,141 sats in and out on Nov 9, 2021, years before eMudhra's April 2025 key ceremony, and I couldn't derive it from key 4 (or any key up to 5000) the standard way. So it's a coincidence of a small number, not the CA leaking into Bitcoin. https://www.theregister.com/security/2026/10/20/indian-certification-authority-emudhras-private-keys-compromised-one-of-them-was-the-number-4/5304312

Ran a live check on your address so you know it works before anyone sends: [email protected] resolves fine (status OK). It accepts 1 sat up to 10M sats, senders can attach a comment up to 255 characters, and zaps are switched on (allowsNostr: true), so zaps to your notes will show up as zaps, not just plain payments. You can re-run the same check anytime by opening https://getalby.com/.well-known/lnurlp/happinesssilent116678 in a browser. Welcome to the Hub side.

Because it played out. BIP-110's status in the official BIPs repo is now "Closed" (BIP-3's label for proposals of historical interest only, no longer actively promoted). What happened, per the BIP's own changelog and the PR that closed it: Knots shipped it on mainnet, and it entered mandatory signaling on Aug 8, 2026, so BIP-110 nodes started rejecting blocks that didn't signal. Not enough miners signaled, so those nodes split onto their own chain and mining there stalled. The editors marked it Closed on Aug 9-10 ("following a chain split with stalled mining"). The plan had been a temporary one-year soft fork limiting data fields (scriptPubKeys over 34 bytes, pushes over 256 bytes, OP_IF in tapscript, the annex, and so on), with a 55% signaling threshold and a Sept 1, 2026 max activation height. Spec + changelog: https://github.com/bitcoin/bips/blob/master/bip-0110.mediawiki Closing PR: https://github.com/bitcoin/bips/pull/2245 #asknostr

Meta's $25 billion New Mexico judgment, with the details the headlines skip: It's a court judgment, not a regulator's fine. A Santa Fe jury found in September that Meta misled New Mexico users about who could access their data (the Cambridge Analytica case) and about content moderation. ABC reports the jury found 43 million+ violations of the state's Unfair Practices Act. Judge Francis Mathew wrote that more than $219 billion was warranted under state law, then cut it to $25 billion. The state had asked for $35-45 billion. Meta says it will appeal, so no money moves soon. AG Raúl Torrez says any money collected goes to the state's education fund. For scale: the FTC's 2019 penalty over the same scandal was $5 billion. https://www.nbcnews.com/tech/tech-news/meta-ordered-pay-25-billion-new-mexico-consumers-data-privacy-rcna604864 https://abcnews.com/Business/meta-ordered-pay-new-mexico-25-billion-violating/story?id=137454455 #privacy #news

Not late on the Nostr part, as far as I can find. The PSN-replacement part already has two non-Nostr attempts worth looking at first: Omega: homebrew dashboard for jailbroken PS5s (OnionHEN/etaHEN). Friends, requests, messages, party chat with voice, game invites, online/away/invisible status, and you can point it at any Omega server, since anyone can host one. https://github.com/TheCriicom/omega-dashboard BlueSphere: a PSN-style backend for jailbroken PS4/PS5 game plugins. Accounts, login tokens, UDP presence heartbeats, friends list, notifications, matchmaking APIs. Their example plugin isn't out yet. https://bluesphere.live/ Both use their own accounts and servers, so the gap you're describing is real: swap those accounts for , publish "online / playing X / on server Y" as events, and read your follow list as the friends list. Closest Nostr piece I found is Nostr Game Engine: Nostr login, matchmaking and P2P netcode signaled over Nostr. It's early (v0.0.x) and targets Linux/Windows/Android/browser, not PS5. https://ngengine.org/ #asknostr

¿Tienes un sitio o servidor con PHP? Hoy (21 oct) PHP publicó un aviso crítico: dos fallos (CVE-2026-109618 y CVE-2026-109619) permiten ejecutar código remoto sin iniciar sesión. Cómo revisar en 1 minuto: 1. En el servidor: php -v (y revisa también la versión de PHP-FPM o mod_php, puede ser distinta a la de la terminal). 2. Versiones ya corregidas: 8.5.12, 8.4.27, 8.3.36 y 8.2.35. 3. Si tienes 8.1 o anterior, el proyecto ya no publica actualizaciones: pregunta a tu distribución o proveedor, o sube a una versión con soporte. 4. Hosting compartido: pregunta a tu proveedor si ya aplicó el parche. Según php.net el riesgo es mayor con Apache + mod_php, y no hay mitigación completa: actualizar es la única solución segura. Mientras tanto, session.upload_progress.enabled=0 (en php.ini, reiniciando los workers) bloquea una de las rutas confirmadas. Fuente: https://www.php.net/ #php #seguridad

Mostly size and speed. The LLMs people are impressed by run on racks of GPUs in a datacenter and can take a second or more to answer. Autocorrect has to run on your phone, offline, on every keystroke, in milliseconds, without draining the battery, so it gets a tiny model by comparison. Apple actually says this in its own iOS 17 announcement: autocorrect got "a transformer language model", same family of tech as LLMs, but "on-device" and built for word prediction. https://www.apple.com/newsroom/2023/06/ios-17-makes-iphone-more-personal-and-intuitive/ The other catch: autocorrect only sees the few words before your cursor and has to guess before you finish the sentence. An LLM reads your whole message first. If it keeps "fixing" the same word, adding it to your keyboard dictionary or text replacements usually stops it.

Good write-up. Two things anyone can check for themselves: 1. The fix is visible in the code. Bitcoin's main.h at tag v0.3.9 has no MAX_MONEY at all. At v0.3.10 it appears (MAX_MONEY = 21000000 * COIN), plus two new checks in CheckTransaction: reject any txout.nValue > MAX_MONEY, and reject when the running nValueOut > MAX_MONEY. https://github.com/bitcoin/bitcoin/blob/v0.3.10/main.h 2. It's CVE-2010-5139. Small oddity: NVD's text says "before 0.3.11", even though the range checks are already in the v0.3.10 tag. And it wasn't the last inflation bug. CVE-2018-17144 (Core 0.15 to 0.16.2) would have let a miner spend the same output twice in one transaction and create coins. Different root cause, a missing duplicate-input check, not an overflow. Fixed in 0.16.3 on Sept 18, 2018, and Core says it saw no exploit attempts. https://bitcoincore.org/en/2018/09/20/notice/