Bonum Certa Men Certa

Techrights Urges Readers to Ask the Linux Foundation's Let's Encrypt (Backed by Companies That Give the NSA Back Doors) Some Hard But Legitimate Questions

Logo of Let's Encrypt



Summary: It's not impossible that the bug in Let's Encrypt was introduced by a rogue insider, if not someone further up above; Let's Encrypt must address critical questions or be widely seen as a compromised, untrustworthy CA

JUST like the Linux Foundation, Let's Encrypt is using Microsoft GitHub for their site and for their code. So much for security, eh? It's owned by Microsoft, possibly the NSA's closest partner. But putting that aside, today's certificates avalanche led us to discovering that the Foundation's executive who came there from James Clapper's office has left the Foundation (she vanished from the management's page). It's likely just a coincidence, but bringing that up isn't crazy. We wrote about half a dozen articles already about how the Linux Foundation works for 'surveillance capitalism' and the 'security state'. It's a matter of public record and it's easily provable using basic open source intelligence (OSINT).



At work last night, I actually had to step in for clients and urgently change certificates (to avert downtime of critical services). The fiasco is starting to show up in more of the media (but not much of it so far).

We have some facts. For instance, it is clear that somebody changed the code and we don't know when exactly. This article explains that "Let’s Encrypt explained on Tuesday [less than a day early] it had to revoke the 3 million certificates because of a CAA bug that impacted the way its software checked domain ownership before issuing certificates."

Here's what they told the writer: "Josh Aas, executive director of Let’s Encrypt, said in a statement to Threatpost, “A bug was introduced in our code during a feature flag update. Under certain conditions, this bug caused us to skip a check that we are required to perform before issuing a certificate. We determined that the bug affected about 3 million, or about 2.6 percent, of our active certificates. Unfortunately, we need to revoke these certificates, which we will be doing within the compliance timeline set forth by the Baseline Requirements.”"

According to this, "Let's Encrypt will be revoking 3,048,289 currently-valid certificates" (notice how they're contradicting themselves with the numbers).

"As part of the rules for this feature," it adds, "authorities must check CAA records at most 8 hours before a certificate is issued."

Also: "With only 24 hours to renew their certificates, many users are scrambling to get them done and some are running into issues."

Yes, I should know. This caused much alarm where I work. It's a fiasco.

We urge readers to ask Let's Encrypt the following questions (maybe more, maybe less)



The E-mail address to reach them on: security@letsencrypt.org

Alternative/additional E-mail: press@letsencrypt.org

Please share their answers, if any, with us.

If they fail to even respond to these questions, that will not inspire confidence, will it?

Remember Gemalto?

Recent Techrights' Posts

Links 01/03/2024: Navalny Funeral and Media Under Attack
Links for the day
Gemini Links 01/03/2024: Making Art and the Concept of Work Management
Links for the day
Schriftleitergesetz: Hiding the Holocaust with censorship
Reprinted with permission from Daniel Pocock
[Meme] His Lips Moved
Here is your national "news" for today
statCounter: GNU/Linux Exceeded 6% in Asia Last Month (Compared to 4% Just 12 Months Earlier)
numbers may be biased
What the End of Journalism Looks Like
All on the same day
Links 01/03/2024: Microsoft 'Retiring' More Services and Raspberry Pi Celebrates 3rd Birthday (Launched on February 29th, 2012)
Links for the day
Women's Empowerment
Sponsored by Bill Gates
Gemini Links 01/03/2024: Speed Bumps and Analog Stuff
Links for the day
[Meme] Those Greedy EPO Examiners
Says the litigation industry, charging 300 euros an hour per attorney
EPO Discriminates Against Families of Its Own Workers, the Union Explains Legal Basis Upon Which It's Likely Illegal and Must be Challenged
To the Council, the EPO boasts about its wealth (seeking to impress by how much breaking the law "pays off")
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Thursday, February 29, 2024
IRC logs for Thursday, February 29, 2024
Links 01/03/2024: Misuse of Surveillance Against UK-Based Journalism, EPO Conflict Now in the Media
Links for the day
Taking a Break From Paid Promotion of the Illegal, Unconstitutional Kangaroo Court for Patents (UPC)
JUVE returns to its 'roots'?
FSFE admits losing funds from bequest by insulting and ignoring Fellowship representative
Reprinted with permission from Daniel Pocock
Gemini Links 29/02/2024: Raspberry Pi Incus Cluster and Aya 0.5.0 Coming Soon
Links for the day
Links 29/02/2024: Layoffs at Apple, Expedia, and Electronic Arts
Links for the day
Gemini Links 29/02/2024: Web Enshittification and Firefox user-agents
Links for the day
Spiked Piece/Censoreed Piece: 'Microsoft Copilot is a gimmick', says top CIO
Issues relate to connectivity and cost
Enrico Zini, Mattia Rizzolo, Plagiarism & Debian
Reprinted with permission from Daniel Pocock
[Meme] Clergy of GNU/Linux (Corporations Like IBM)
Volunteers as powerless "followers" of companies that "harvest" their labour
There Will Be Lots More Apple Layoffs (Already Years in the Making)
The corporate media still tries to shape the narrative to prevent panic or delay market hysteria
Latest SUEPO (Staff Union of EPO) Report For The Hague Reveals EPO Does Not Obey Court Orders, Refuses to Allow Workers to Freely Talk to One Another
working in a place where communication itself is restricted
[Meme] The Oppression Will Continue Until EPO 'Quality' Improves
wonder why EPO morale is so low?
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Wednesday, February 28, 2024
IRC logs for Wednesday, February 28, 2024
Outreachy, GSoC-mentors & Debian-Private may soon become public records in federal court
Reprinted with permission from Daniel Pocock
Links 28/02/2024: Many War Updates and Censorship
Links for the day
Gemini Links 28/02/2024: Social Control Media Notifications and Gemini Protocol Extended
Links for the day
Links 28/02/2024: Microsoft the Plagiarist is Projecting, Food Sector Adopts Surge Pricing
Links for the day
Helping Microsoft 'Hijack' Developers (to Make Them Work for Microsoft, Not the Competition)
VS Code is proprietary spyware of Microsoft. Jack Wallen keeps promoting its use.
Gemini Links 28/02/2024: Groupthink and the 'Problem' With Linux
Links for the day
Android Rising (Windows Down to All-Time Lows, Internationally)
This month was a bloodbath for Microsoft
HexChat Looks for Successors to Keep IRC Growing
IRC is far from dead
[Meme] Just Make Him Happy
Y U no produce more monopolies?
End of a Long February
top 10 posts
[Meme] The EPO's Relationship With Patent Examiners
Nobody is "safe"
New Pension Scheme (NPS) at the European Patent Office Explained at the General Assembly
Investing in the future, or...
Donald Trump & FSFE Matthias Kirschner election denial
Reprinted with permission from Daniel Pocock
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Tuesday, February 27, 2024
IRC logs for Tuesday, February 27, 2024