> We have done some preliminary assessment, there appears to be a flaw in the KGC script that was used on that specific day to create these ECC issuers. As for these ECC keys, our review of the KGC, assessment of the code and view of HSM keys so far indicate that a) a set of original ECC keys were created onboard as expected b) an approved deviation to our usual KGC to test a wrap/unwrap was introduced as these keys were meant for export for this instance c) a flaw in the code resulted in the second pair of keys being created onboard which were weaker d) these second pair of weaker keys were used by mistake to create the csr (because the key labels were similar) and signed by our root e) the CSR from these weaker keys were also sent over to Sectigo for cross signing (we verified the files sent over to Sectigo)
`a flaw in the code resulted in the second pair of keys being created onboard which were weaker`
that sounds like the HSM is capable of generating keys in a range that is smaller than [1..group_order). such a feature makes no sense at all. or is this some kind of weird thing where people want to generate weak keys for 'testing' and HSM vendors have added such a strange feature. its actually satisfying to see someone get burned by this because such a feature should never exist and this is the reason why. if the HSM can generate keys in a smaller range (especially some arbitrary small range) then you are putting a lot of trust in the operators of the HSM. hopefully there are good audit logs and people actually check the audit logs every time keys are generated to make sure the keys being generated aren't from a special range.
Maybe it follows openssl keygen process: you first generate private key, then export public key from it as k*G. In case of ecc private key is a random number, streamed from RNG, but RNG doesn't know for what purpose you generate a random number and can generate a number of any size.
Most large cities in the world have had thousands of public CCTV cameras for decades. Traffic enforcement cameras have been super normal for even longer.
I am not talking about those. These cameras were targeted and pointing directly into peoples windows, set up by the local police department, under the guise of being electric utility boxes.
In August 2020, this was unbelievable, and it would have been considered reasonable (if wrong) to dismiss OP as paranoid, especially for the subreddit they posted in.
It's just marketing. They want people to believe they're selling super intelligence that is powerful enough to destroy the world of it fell into the wrong hands. It's much more effective than saying that you have a slightly more effective slop generator which obviously has no actual intelligence.
Even the models we have access to can do basic coding tasks really well, in a way they couldn't a year ago.
I don't really care what you call "intelligence" - what matters is capability, and the consequences of that capability.
They're not selling the superintelligence yet - the models in the Hacking Face incident and that solved the Millennium prize are not released yet. And that is by no means the final capability level the current process looks like it will get to.
This actually is a result of Meta being forced to obey EU law. Not sure why the article didn't explain things at all, but Regulation (EU) 2024/900 greatly restricts political advertising with typical vagueness, so Meta is enforcing a broad ban to ensure they comply.
Information like this should be front-and-center. Call it malicious compliance if one wishes, but if there is one thing that is clear, Meta does not do anything (besides try and make money) without being forced to. A blanket ban on anything political does indeed mean a ban on all sides of an issue, even ones many would agree is positive.
The comment you’re responding to and that you want front and center is plainly wrong. The regulation is about transparency and restricting targeted advertising technics for political advertising. That has nothing to do with the situation at hand, it is meta doing something on their own.
And your point about Meta being forced to act is also wrong, companies aren’t just passive institutions that only react to regulations, they constantly take decisions and actions, and regularly manufacture that type of situation as a way to lobby regulators
It doesn't ban political advertising, it requires labeling/transparency, and prohibits targeting without consent or based on categories like race or religion.
It also defines political ad narrowly as placed by a political actor or campaign, or intended to influence some part of the political process, like voting, legislation, or regulatory action.
If that were the case, we wouldn't have far right AI generated political ads everywhere in Facebook. Just one example from France this week[1]
I don't know what motivation Facebook has to automatically limit certain political advertising and not other, but it certainly has nothing to do with EU regulation
an AD for a theater play is by no standard political advertisement
Political advertisement in the regulations context is reasonable clearly defined.
An AD for a theater play is in general very clearly _not_ covered by it.
To add to it: Civil rights & feminism (in it's official non hijacked definition, aka. equal fair treatment of man and women) are fundamental rights in the EU, something the regulation very clearly states it doesn't want to impeach on. So arguments that you could accidentally misread the regulation to include banning _non-political advertisement about artistic work covering fundamental rights are a bit absurd_.
Anywhere here is the definition of political advertisement in given regulation:
> political advertising’ means the preparation, placement, promotion, publication, delivery or dissemination, by any means, of a message, normally provided for remuneration or through in-house activities or as part of a _political advertising campaign_:
> (a)by, for or on behalf of a _political actor_, unless it is of a purely private or a purely commercial nature; or
> (b) which is liable and designed to _influence the outcome of an election or referendum_, voting behaviour or a legislative or regulatory process, at Union, national, regional or local level;
(emphasis mine)
So to put it simple: Meta is engaging in censure.
Stretching the term political to include more or less everything (like any topic people have opinions about a politician might speak about) is IMHO a pretty dishonest misinterpretation, especially given that it isn't even everything, but "everything Meta doesn't want to get involved with due to the current political environment".
At best this misinterpretation is due to laziness, at worst pushed by malicious actors in the US.
Given that Meta is a US company and the currently people in power there find this topics quit unpleasant and Metas long history of not faithfully complying with law and allowing all kind of ADs this looks very bad for them.
"Designed to influence…voting behaviour" is incredibly vague. A play with political undertones could absolutely fit that definition. I understand that's not what was intended by the law, but if someone was advertising plays with support for policies you didn't like, you likely would be calling that political.
More relevantly, a broad, vague policy means an EU regulator can prosecute Meta whenever they feel like it if Meta does not go overboard.
it really isn't in practice, only if you take things out of context of the rest of the law, the clearly communicated intend of the law (which matters for judges) and of how law in general works
This also isn't reverse construction in any form, just because something might end up influencing voting behavior doesn't mean its "political". Advertising for artistic work covering common social topics doesn't make this political ads. Nor does advertising for documentations, even if they cover a topic which could influence votes. If you look at the definition in the actual regulation that is pretty clear.IMHO
the law came into effect due to widespread advertising campaigns on facebook by someone (often thought to be russian government based) for both sides of any culture war topics, presumably to drive division. Things like simultaneously advertising BLM/ACAB + thin blue line.
> so Meta is enforcing a broad ban to ensure they comply.
No. Meta enforces a broad ban because they don't want EU to regulate them, so they drag their feet and create the most possible "unwanted collateral damage" so people will get upset at the regulation instead of the company. So, pieces like this from The Guardian are surely needed.
If cookie consent dialogs have been going on for as long as they have, can they really be called malicious compliance at this point? Seems like people believe that is the actual intent of the regulation at this point.
I personally see fewer and fewer of those original dialogs that had you deny 20-30 items one by one. Most of the pages I land on have the deny all button or have given up on pretending they care.
Meta aren't 'forced' to do anything other than treat the fines imposed by their lack of adherence to the laws of the territories they operate in as a BAU cost. Meta's profits run roughly the same as the GDP of Paraguay ($60.46 billion in 2025) - i.e. that Country's total value added by an economy through wages, profits, and taxes. Their revenue is on track to exceed the Ukrainian GDP next year.
This year Meta will pay up to $16.7bn to settle landmark US legal actions as result of not obeying US law, reporting $2.4 billion in legal fees in Q2 alone.
The sum total of the EU fines issued (read: appealed and not collected) likely won't even exceed Metas legal fees for the 2026 calendar year; i.e.:
* April 2025 - €200m (DMA "consent or pay" advertising model)
* November 2024 - €797.72m (Antitrust re:Facebook Marketplace)
* September 2024 - €90m (Storage of user passwords in plaintext)
* May 2023 - €1.2b (Unlawful EU-U.S. user data transfers)
* January 2023 - €390m (Forcing personalized ads via terms of service)
* December 2022 - €251m (2018 data breach and system design lapses)
* November 2022 - €265 (Inadequate protection against data scraping)
* September 2022 - €405m (Instagram children's privacy)
No, showing ads for feminism or social issues related plays is not illegal in Europe. Nor fined. And it is practically practiced all around the Europe.
This strategy of "we will lie about what the law enforces, so that we can blame the regulator instead of the company" is getting old.
Not to mention the adversarial risk. Prompt injection, LLM-maximized advertising, and just common scams are going to take so much money if these catch on.
Running code through a deterministic formatter definitely helps a lot, but I've generally found LLMs' comments to add no-to-negative value. They just say what code does, typically very verbosely that just inflates files more while also just stating the most obvious aspects of the code and not adding any meaning behind it because they obviously don't know that. Not to the mention all the cases where they make mistakes and then you have code you don't intuitively understand and also have comments telling you it does something it doesn't.
Or worse, the comments are a tutorial through the changes for your review, referring to something that now doesn't exist because of the changes you're making. Less than informative, literally backwards facing.
Edit: Linode just updated its mirror.
reply