03.04.20

Gemini version available ♊︎

Techrights Urges Readers to Ask the Linux Foundation’s Let’s Encrypt (Backed by Companies That Give the NSA Back Doors) Some Hard But Legitimate Questions

Posted in GNU/Linux, Security at 3:43 am by Dr. Roy Schestowitz

Logo of Let's Encrypt

Summary: It’s not impossible that the bug in Let’s Encrypt was introduced by a rogue insider, if not someone further up above; Let’s Encrypt must address critical questions or be widely seen as a compromised, untrustworthy CA

JUST like the Linux Foundation, Let’s Encrypt is using Microsoft GitHub for their site and for their code. So much for security, eh? It’s owned by Microsoft, possibly the NSA’s closest partner. But putting that aside, today’s certificates avalanche led us to discovering that the Foundation's executive who came there from James Clapper's office has left the Foundation (she vanished from the management's page). It’s likely just a coincidence, but bringing that up isn’t crazy. We wrote about half a dozen articles already about how the Linux Foundation works for ‘surveillance capitalism’ and the ‘security state’. It’s a matter of public record and it’s easily provable using basic open source intelligence (OSINT).

At work last night, I actually had to step in for clients and urgently change certificates (to avert downtime of critical services). The fiasco is starting to show up in more of the media (but not much of it so far).

We have some facts. For instance, it is clear that somebody changed the code and we don’t know when exactly. This article explains that “Let’s Encrypt explained on Tuesday [less than a day early] it had to revoke the 3 million certificates because of a CAA bug that impacted the way its software checked domain ownership before issuing certificates.”

Here’s what they told the writer: “Josh Aas, executive director of Let’s Encrypt, said in a statement to Threatpost, “A bug was introduced in our code during a feature flag update. Under certain conditions, this bug caused us to skip a check that we are required to perform before issuing a certificate. We determined that the bug affected about 3 million, or about 2.6 percent, of our active certificates. Unfortunately, we need to revoke these certificates, which we will be doing within the compliance timeline set forth by the Baseline Requirements.””

According to this, “Let’s Encrypt will be revoking 3,048,289 currently-valid certificates” (notice how they’re contradicting themselves with the numbers).

“As part of the rules for this feature,” it adds, “authorities must check CAA records at most 8 hours before a certificate is issued.”

Also: “With only 24 hours to renew their certificates, many users are scrambling to get them done and some are running into issues.”

Yes, I should know. This caused much alarm where I work. It’s a fiasco.

We urge readers to ask Let’s Encrypt the following questions (maybe more, maybe less)

  • When did you find out about this bug?
  • Why was it not there before?
  • Which worker is responsible for this bug?
  • When was this worker hired?
  • Is this worker still working for you?
  • Why were the certificates all revoked so fast?
  • Why was this barely announced to the public? Should the Foundation not shout from the rooftops to avert disasters (as opposed to saving face)?
  • Were particular parties/stakeholders informed well in advance?
  • Were government entities informed in advance (in the name of “national security”) and, if so, how long in advance?

The E-mail address to reach them on: security@letsencrypt.org

Alternative/additional E-mail: press@letsencrypt.org

Please share their answers, if any, with us.

If they fail to even respond to these questions, that will not inspire confidence, will it?

Remember Gemalto?

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

Decor ᶃ Gemini Space

Below is a Web proxy. We recommend getting a Gemini client/browser.

Black/white/grey bullet button This post is also available in Gemini over at this address (requires a Gemini client/browser to open).

Decor ✐ Cross-references

Black/white/grey bullet button Pages that cross-reference this one, if any exist, are listed below or will be listed below over time.

Decor ▢ Respond and Discuss

Black/white/grey bullet button If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

DecorWhat Else is New


  1. [Meme] Linus Gabriel Sebastian Takes GNU/Linux for a (Tail)'Spin'

    If you’re trying to prove that GNU/Linux is NOT Windows, then “haha! Well done…”



  2. GNU/Linux is for Freedom and It'll Gain Many Users When (or Where) People Understand What Software (or Computing) Freedom Means

    Software that respects people's freedom (and by extension privacy as well) is an alluring proposition; those who choose to try GNU/Linux for the wrong reasons are likely the wrong target audience for advocates



  3. Amid Reports of Microsoft's Competition Crimes in Europe...

    European companies are complaining, but they seem to overlook the principal aspect of an imperialistic system with bottomless pockets (almost 30 trillion dollars in debt already; US national debt soared again last month); Microsoft is shielded by a political system with military (“defence”) as bailout budget to help cushion international expansion for data grab and technical leverage, as we've seen in the case of EPO (this is all political, not technical, and should thus be treated as a political/corruption issue)



  4. Is Linus Trolling the GNU/Linux Community?

    This new video responds to what many sites have been provoked into amplifying



  5. Links 27/11/2021: Tux Paint 0.9.27 and SeaMonkey 1.1.19 in EasyOS

    Links for the day



  6. [Meme] Keeping Our Distance From Microsoft

    The OSI is the dagger, the Linux Foundation is the knife, and many others are the sword by which Microsoft tries to get into the very heart of GNU/Linux and extinguish the Free software movement



  7. Microsoft Edge Encourages Indebted Americans to Guilt-spend Just in Time for Christmas

    Guest post by Ryan, reprinted with permission



  8. IRC Proceedings: Friday, November 26, 2021

    IRC logs for Friday, November 26, 2021



  9. 38+ Years of GNU and 19+ Years of FSF Associate Membership

    “On November 25, 2002,” Wikipedia notes, “the FSF launched the FSF Associate Membership program for individuals.” As the above video points out, it all started almost 40 years ago.



  10. Gemini as a Platform for Gamers

    Contrary to what people often assume (or are led to assume), even without client-side scripting Gemini can accomplish a great deal; early adopters, many of whom are technical, test the limits of the very minimalistic (by design and intention) specification



  11. Improved Workflows: Achievement Unlocked

    Today we've completed a bunch of small projects that can make us more efficient (e.g. more Daily Links per day, more articles); the above video was recorded many hours ago to accompany the outline below



  12. Links 26/11/2021: New Complaint About Microsoft Competition Crimes in Europe, EuroLinux 8.5, GhostBSD 21.11.24, and Kiwi TCMS 10.5 Released

    Links for the day



  13. Links 26/11/2021: F35 Elections, Whonix 16.0.3.7, OSMC's November Refresh With Kodi 19.3

    Links for the day



  14. IRC Proceedings: Thursday, November 25, 2021

    IRC logs for Thursday, November 25, 2021



  15. IRC Proceedings: Wednesday, November 24, 2021

    IRC logs for Wednesday, November 24, 2021



  16. Links 25/11/2021: PHP 8.1.0 Released and Linux 5.15.5

    Links for the day



  17. IBM as Master of Hypocrisy

    Free software projects and Free software developers have long been humiliated by corporations of Western misogynists, falsely claiming that the Free software community isn’t inclusive enough (these are shameless projection tactics; as a matter of public record, the exact opposite is true) and even the eradication of supposedly offensive language isn’t something IBM takes seriously



  18. Links 25/11/2021: LibreOffice 7.2.3 and Mesa 21.2.6 Released

    Links for the day



  19. [Meme] So Desperate That Edge Cannot Even Exceed 4% That They Block Rival Web Browsers

    Linux/Android/Free Software/GNU (they go by very many names/brands) may continue to grow to the point where Windows is as irrelevant as Blackberry; this means that Microsoft’s grip on the Web too has slipped — to the point where Microsoft frantically uses 'bailout' money to hijack LinkedIn, GitHub, etc. (it also rebrands almost everything as "Azure" or clown to fake a perception of growth)



  20. Windows Vista Service Pack 11 (Vista 11) Has Failed to Curb the Growth of GNU/Linux

    Windows market share continues to decrease in spite of billions of dollars spent bribing the media for fake hype, especially in light of a new Windows Service Pack (SP), Vista SP 11



  21. Links 25/11/2021: Proton 6.3-8 and Linux Mint Compared to Ubuntu

    Links for the day



  22. 3.5 Years Later the 'Master' of Fedora is Still Microsoft and IBM Cannot Be Bothered to Alter Git Branch Names (Refuting or Ignoring Its Very Own Directive About Supposedly Racially-Insensitive Terms)

    Today we demonstrate the hypocrisy of IBM; years after telling us that we should shun the term "master" and repeatedly insisting it had a racist connotation at least 65 Fedora repositories, still controlled by Microsoft, still use "master"



  23. Changing the Arrangement While News is a Bit Slow(er)

    I've made it easier for myself to keep abreast of things like IRC channels and networks (incidentally, a day ago Freenode reopened to anonymous logins) and I've improved monitoring of the Web sites, Gemini capsule etc. (this video is unplanned and improvised)



  24. Links 24/11/2021: Alpine Linux 3.15 and Endless OS 4.0 Released

    Links for the day



  25. [Meme] Jimmy Zemlin Loves Microsoft

    It’s funny, isn’t it? Lying for a living and sucking up to the liars pays off; you get to plunder actual Linux users while leaving Linux morally and financially bankrupt



  26. Links 24/11/2021: PHP Foundation and Flatpak Criticisms

    Links for the day



  27. IRC Proceedings: Tuesday, November 23, 2021

    IRC logs for Tuesday, November 23, 2021



  28. Links 24/11/2021: Rust Crisis and Team UPC Still Faking 'Progress'

    Links for the day



  29. Links 23/11/2021: New GNU Parallel and Memories of David H. Adler (Perl, Raku)

    Links for the day



  30. In Light of Fast-Accelerating Deterioration -- Sometimes Weaponisation -- Getting Off the World Wide Web (to the Extent Feasible) Makes You Saner and Less Susceptible to Manipulation, Lies

    Almost no sites are speaking about it (probably because they have no presence on the Internet except on the Web), but it's time to motivate more people to get off the Web, for their own good and for society's sake...


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts