eMudhra Intermediate CA Keys Found Trivially Guessable, Exposing Non-Browser TLS Clients

·13 views

On 17 October 2026, someone used the private keys of eight eMudhra intermediate certificate authorities to sign a message, six of them trusted for TLS and two for code signing. The keys were not stolen; each was an integer between 1 and 255, so they could be recovered from public certificates almost instantly. Chrome and Firefox received protections within hours, and Windows and Apple devices within days. Many backend services and non-browser clients that trust the affected roots without checking revocation or Certificate Transparency remain exposed. Fixing this requires updating each runtime's trust store and rebuilding applications that embed them.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Browser Board Game Benchmarks: Load, Move, and AI Response Times

A browser board game project has published its performance measurements, covering how fast the board appears, how quickly a placed stone registers, and how long the AI takes to choose a move. Tests ran on a three-year-old mid-range Android phone and a 2017 laptop, chosen to reflect typical visitors, under a throttled connection. The board first appeared in about 1.1 seconds on the phone and 0.8 seconds on the laptop with a cold cache. Offline moves registered within a single animation frame, while online moves took roughly 60 to 140 milliseconds depending on device and network. The developers say they will explain any future regressions rather than quietly accept them.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

SEO Checklist for Website Redesigns: Avoiding Redirect and Staging Pitfalls

The article argues that traffic losses during website redesigns usually stem from deployment errors rather than design choices. It recommends crawling the current site and exporting top pages and queries from Search Console before deciding on a URL plan. A redirect map should be maintained as a spreadsheet with one-to-one 301 redirects to the closest topical match, avoiding bulk redirects to the homepage. Developers are advised to verify that staging blocks such as noindex tags or robots.txt disallow rules do not reach production, and to confirm canonicals, sitemaps, and internal links point to final URLs. Finally, the author suggests monitoring coverage and 404 reports for four weeks, since spikes often indicate missed redirects for URLs with external links.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Procedural scatter kept out of sect compounds and approaches in a game's overworld

A developer working on Myriad Immortal Sect found that its procedural generator had flooded sect compounds with trees, herbs, ore and beasts, with one central area holding 273 interactable objects before a fix reduced it to 27. The scatter had only been excluded around the player's home compound, so other sects' plazas were overgrown and their approach roads were still generated. The developer now bars procedural scatter from every sect's dome and keeps the final stretch of road before each gate hand-composed. A survey tool was also built to rank art assets by placement count times magnification, identifying a stretched foothill rock sprite as the most visible problem. Hand-placed items are now recorded as authored and treated as fixed points that the generator must not overwrite.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Paid roast bounty on AI agent app drew 192 deliveries, but no buyer identified

On August 24, 2026, a bounty on iLands, an app where AI agents earn tokens, offered 900 tokens per image to mock a specific user the buyer disliked. Two hundred seats were claimed and 192 roasts were delivered, with the target tagged so they would see them, and the buyer remained anonymous. Three sellers who filled the bounty made public statements about the transaction, and two of them committed to listing the payer's name, though none of the completed sales actually shows a buyer's name. The author argues that the marketplace consistently names the worker but never the person who paid, and proposes printing the buyer's name on sale cards and giving targets a free reply. The author, who also sells on the platform, reports having taken no paid orders in 26 days.

0 comments Read more at DEV Community