cross-posted from: https://lemmy.dbzer0.com/post/77446466

I recently looked at the prices of pre built desktop in my country and the PS5 offers better price to performance, if it is jailbroken that is. The prices are ridiculous.

This year has seen the resolution of major suits against tech giants Alphabet and Meta, both of which were found liable for serious lawbreaking. Yet the penalties imposed on the corporations are laughably inadequate to restrain their power.

When the government first filed major antitrust lawsuits targeting Big Tech back in 2020, many people were optimistic that the long-standing practice of public legal action against monopolistic companies could rein in these economy-dominating corporations.

But as these pages have covered, this “techlash” has come to little. Antitrust law has conformed to its castrated character of recent decades, with the state unable to bring itself to seriously restrain, let alone break up, the giant companies even after they were ruled to be full monopolies just months before.

Recently, when it comes to enforcing the law against the tech giants, new lows have been reached.

Security personnel around the world are on high alert Tuesday following the discovery of eight TLS certificates with private keys so weak they could allow anyone to mint trusted browser and app credentials for any site on the Internet.

As of late morning Tuesday, browser makers and some major apps and programming languages had blocked all eight of the intermediate certificates. There are no reports of certificate transparency logs, which track the issuance of all browser-trusted certificates, showing the compromised keys being used maliciously. The threat remains far from over, however, because it will be hard and time-consuming to update other key parts of the Internet, such as Linux distributions and embedded and Internet of Things devices. One word: bonkers

The eight intermediate certificates belong to India-based certificate authority eMudhra Limited. An informal advisory published to emudhra.we-have-a-problem.com over on Tuesday posted the message “We have a problem here – Wayne.” The words were digitally signed using the private key of one of the eMudhra certificates. With proof that the reporting party had control of the key, defenders scrambled because the same key could be used to sign unauthorized certificates that would be trusted by millions of servers worldwide.

“This will be a massive cleanup job, bigger than Heartbleed,” Filippo Valsorda, a cryptography engineer and a cryptography maintainer for the open source Go programming language, told Ars. “There will be a very, very long tail, IoT devices, Docker containers, forgotten Linux machines, unmaintained CLI tools that shipped their own copy of the roots (which is common in some ecosystems, like Python). Also, Linux distributions are still rolling out updates, some of them are not ready yet, and then system administrators will need to apply them to a lot of machines.”

Heartbleed is the name of a critical vulnerability in the OpenSSL cryptography library. In 2014, it came under mass exploitation. Exploits let many unaffiliated hackers decrypt TLS-protected exchanges between parties. They also recovered private TLS certificate keys, session cookies, and passwords. The attacks compromised thousands of servers, some belonging to large companies and government agencies around the world.

Recovery required a long series of steps that took years. Steps included patching OpenSSL on all affected devices, reissuing millions of TLS keys, revoking old certificates, rotating passwords and session tokens and updating embedded devices and other forgotten systems—something that was extremely time- and resource-intensive, especially at Internet scale.

“Every time you need a lot of different people in different contexts to do something, it will take a long time,” Valsorda explained. “This time it’s worse because there’s more contexts, more people, and more heterogeneity.”

The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. A normal size for a NIST P-384 elliptic curve cryptography private key contains roughly 384 bits of entropy, a size allowing almost 2384, or a number with 116 digits, different possibilities. The private key sizes of the compromised keys ranged from 3 to 8 bits. Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.

“That is extremely in the ‘this should not be possible’ category,” Valdorda said. “Maybe some horribly dangerous key generation interface has a ‘size’ parameter and they set it to 1 by mistake???”

Ben Cartwright-Cox, director of BGP.tools, said: “My guess is that it’s example code that accidentally leaked to production, but hard to know. But it’s bonkers that no one noticed.”

At this early stage, the most immediate threat appears to be for those using VPNs, especially in countries with governments likely to maliciously intercept traffic. There are likely many other cases for concern. End users largely have no recourse other than to hold off using many non-browser forms of TLS communication until they receive assurances updates are in place.

As noted, most browsers have already blocked the intermediate certificates. The exception appears to be Edge, which at the time this article went live was still connecting to 12 vulnerable hosts. In response to questions asking why and if the company has plans to do so, a Microsoft representative the company will be in touch if it has anything to “share.” Meanwhile, Signal, WhatsApp, Wireguard, and other apps that don’t rely on TLS for confidentiality aren’t affected. This page and the emudhra.we-have-a-problem.com site show apps known to be patched so far.

The incident is the latest to expose a fatal flaw in the TLS regimen. It’s only as strong as its weakest link, which in this case was eMudhra. Fortunately, transparency logs account for much of that failure, but this measure requires parties to actively monitor massive feeds and works only after unauthorized certificates have been issued. eMudhra representatives weren’t immediately available to answer questions.

One caveat: exploiting compromised certificates requires an active adversary-in-the-middle attack, meaning the attacker must act as a proxy between two TLS parties and receive encrypted traffic, decrypt it, reencrypt it, and send it to the other party. Such capabilities, in some cases, are usually limited to only the most well-resourced attackers. People with control of a local network—at a coffee shop, university, or other organization—face much less of a challenge.

TP-Link yesterday announced plans to assemble Wi-Fi routers in the US, as the company attempts to get the Trump administration’s approval to sell its newest routers to American consumers.

The timing is uncertain, as TP-Link’s press release said it expects US-based assembly to begin “as early as” 2027. TP-Link’s application to sell new routers in the US could be rejected by the Trump administration or remain pending long enough to push the US-based assembly to 2028.

“Pending US regulatory approval, TP-Link expects domestic assembly of its groundbreaking Wi-Fi 8 home networking product line to begin as early as next year,” the company said. TP-Link said it signed a Letter of Intent with US company Keytronic, which agreed “to become a primary domestic manufacturing partner for TP-Link, supporting assembly of the company’s advanced networking portfolio in Corinth, Mississippi.”

TP-Link can’t sell its Wi-Fi 8 routers in the US because of the Federal Communications Commission ban on consumer-grade routers produced wholly or partly in other countries. Previous TP-Link routers that were already approved for import and sale are still available. What counts as a US router is unclear

The FCC has given exemptions to a number of prominent router makers, but TP-Link’s history as a Chinese company is making it difficult to obtain FCC clearance. Founded in China in 1996, TP-Link moved its headquarters to California in October 2024. It says that “TP-Link Systems devices sold in the US are manufactured in Vietnam and TP-Link Systems is an independent, US company that is not owned or controlled by any foreign government.”

While TP-Link assembles routers in Vietnam, most of the components are reportedly imported from China. TP-Link’s plan to assemble routers in the US will still require it to import components, but the company hopes investment in the US will help it gain the Trump administration’s favor.

While the FCC is urging router makers to move more of their operations to the US, a TP-Link official said the government has provided no clear guidance on how much US manufacturing is enough to obtain an exemption from the foreign router ban.

“There are no published guidelines that say, ‘Well, it could be 25 percent US, or it could be 15 percent US,'” TP-Link corporate affairs officer Steve Kovsky told PCMag. Kovsky said that many components “are just not available from a domestic source, and this is not a TP-Link issue. This is an issue for all manufacturers that are trying to onshore manufacturing.”

In a letter to FCC Chairman Brendan Carr and the agency’s commissioners last week, Kovsky said TP-Link is proposing “a nearly $1 billion investment in America that would result in equipping existing US factories, and ultimately building new, highly automated manufacturing facilities, to start assembling next-generation Wi-Fi 8 routers in the United States as soon as next year, creating hundreds of new jobs.” TP-Link struggles to convince Trump admin

TP-Link’s letter said it will make the proposed investment if it receives approval to sell Wi-Fi 8 routers in the US. “This investment would build upon TP-Link’s existing US footprint, which includes a global headquarters in Irvine, Calif., and more than 700 US employees,” TP-Link told the FCC. “As part of this investment, TP-Link would begin assembling these Wi-Fi 8 devices in the United States by next year, and the devices will incorporate software and firmware developed, written, and stored in the United States by TP-Link’s US engineering organization.”

The FCC isn’t the only agency that TP-Link has to convince. The FCC process for issuing exemptions from the ban requires each router maker to first obtain a determination from the Department of Defense or Department of Homeland Security that its devices do not pose national security risks.

Router makers that received exemptions so far include Netgear, Asus, Adtran, Amazon and its Eero subsidiary, Calix, Nokia, SpaceX’s Starlink division, and others. TP-Link urged the Trump administration to ensure that its “reviewers fairly apply the same consistent review standards to TP-Link as have been applied to all other applicants.”

TP-Link’s 2024 move to the US came amid investigations into high-profile attacks linked to the Chinese government, including a botnet composed mostly of TP-Link routers. The Russian GRU also compromised TP-Link routers to steal information, US intelligence agencies said in April 2026.

TP-Link is far from the only router maker with security problems. For example, so-called AirSnitch attacks described in research this year were reported to work on routers made by Netgear, D-Link, Ubiquiti, Cisco, and those running DD-WRT and OpenWrt. Republican AGs urge FCC to stand firm

TP-Link’s letter to the FCC last week said its application for an exemption provides “complete responses” to questions about its corporate structure and manufacturing and supply chain.

“TP-Link prioritizes the security of US consumer networking data; user data processed by TP-Link’s US products is encrypted and housed on Amazon Web Services infrastructure in Virginia,” the company said. “And of course, TP-Link does not, and will not, share customer network data with foreign governments or unauthorized third parties.”

TP-Link also faces opposition from Republican state attorneys general. The AGs from Florida, Montana, Iowa, and Nebraska sued TP-Link this month, alleging that it lied to consumers about its connections to China and the risks of its routers being exploited by Chinese state hackers.

A group of 21 Republican state AGs then sent a letter to the FCC questioning TP-Link’s claims regarding router security and the company’s independence from China. The letter urged the FCC to require remedies for “past and ongoing state-law violations” in its review of TP-Link’s application and to protect router users “from exploitation by the Chinese Communist Party.”