floof.org
The God of Bad Art gets offerings from all over the world, but in Their temple, They sometimes appear.
"Why bad art?" I ask.
"It is brave", the God replies.
"To try and fail?"
"No," the God chuckles. "Any creative work is a defiance of entropy, of Death itself. If you create, you do not fail."
Shrike & Beeb's new client isn't all that he seems...Help us get our Patreon funding to $15k a month keep these episodes coming! https://www.patreon.com/Monk...YouTube
A post-party mess. The little robot vacuum slid around the penthouse apartment cleaning up crumbs, champagne, and broken glass.
The music had been loud enough to rattle its bristles, rowdy laughter had assaulted its sensors. Then there'd been a torn sleeve. Sobbing. Stumbling steps.
Now there was its owner, the cause of the sobs by the balcony. One little scoot, a little scooch, under one foot, the other. The trash screamed all the way down.
When you're on the boat, you have to find the skipper!
@funsizefox.bsky.social
#BLFC #BLFC2026 #FursuitFriday
๐ธ @shutterwolf
https://www.furtrack.com/home/2299592
Fursuit photo/video sharing & searching for the furry fandomwww.furtrack.com
RE: https://tenforward.social/@nivex/117486661160031283
I've yet to see a human endeavour which isn't about money and power.
Computers were not a mistake.
The Internet was not a mistake.
The mistake was allowing everything to be about money and power rather than community building.
Here's Vaelen the marten.
This time I wanted to play around a little with lighting, shadows, and perspective, trying out a different angle with the sunlight hitting him. Mostly just experimenting and having fun with it!
Drawing for Archer
Traditional, markers and colored pencils.
If you want to watch the process of this drawing, I recorded a time-lapse video, you can watch the short version on the first comment of my Telegram art channel: https://t.me/panda_paco
The full version video, with the full resolution and scanned version of this, plus more drawings I haven't shared yet on my galleries, can be found as exclusive for Patreons and Ko-Fi monthly supporters. You can join the club and support to keep doing this for a living, and receive many exclusive shinnies.
Patreon: https://www.patreon.com/c/pandapaco
Ko-Fi: https://ko-fi.com/panda_paco/tiers
Thank you!
Official Art Channel ๐ฒ๐ฝ Clean cute artist. Full-Time Panda. Here to paint some smiles. https://linktr.ee/panda_paco Patreon: https://www.patreon.com/pandapaco Ko-Fi Shop: https://ko-fi.com/panda_paco/shop Stickers channel: @pacostickersTelegram
Taken on the last day of WPAFW 2026, as the sun was going down. Sparkle Tooth (AKA Carpet Sample, per badge) and Zarkey pose behind the lodge.
#FursuitFriday #WPAFW2026 #Fursuit
Everyone took the shortcut through the graveyard.
It closed at night, but I was in a hurry, and the groundskeepers were busy watching The Big Game. They hadn't even seen me fall over the gate.
My phone lit the path.
A crack of wood made me jump. The gnarled hands clawing through the dirt made me freeze.
The zombie pointed at me, "Give phone!"
The rest of my walk was dark but I could still hear the zombie cheering its favorite team.
From a fun-loving kid in Glipwood, to the Strander Chief of the East Bend, to lowly wolf who can't remember his name, the brave High King of Anniera... Kalma...YouTube
Taken just after the Kaiju Stomp at WPAFW2026, where multiple Kaiju (fursuiters) rampaged through a city (cardboard boxes of various sizes).
I'm walking a bit oddly because my right bootie has come loose inside my hindpaw and I'm trying to make it to a seat before I lose the paw completely. Of course, as soon as I sat down the bootie slid back into place and stayed there the rest of the day.
๐ธ - Rump
#WerewolfWednesday #WPAFW2026 #Fursuit
@colinstu @pippin The long brown NFT fur "mane" over the shoulders and down the back was done back in 2002, but it needs sunlight to really pop.
I'm slowly replacing the shorter dark grey NFT fur on the rest of the body; for some reason it's kinked up over the years and just doesn't look good anymore.
Meet Stitches! Just a handsome fox looking pretty good without even trying.
This one was done traditionally with markers and colored pencils.
I also recorded a time-lapse video of the drawing process! You can watch it in the first comment on my Telegram art channel: https://t.me/panda_paco
As well, you can watch a longer video of the process, all the full files, and more drawings I haven't posted on my galleries, all this at supporting me on Patreon or Ko-Fi, check all the tiers and rewards you can get:
Patreon: https://www.patreon.com/c/pandapaco
Ko-Fi: https://ko-fi.com/panda_paco/tiers
Thank you!
Official Art Channel ๐ฒ๐ฝ Clean cute artist. Full-Time Panda. Here to paint some smiles. https://linktr.ee/panda_paco Patreon: https://www.patreon.com/pandapaco Ko-Fi Shop: https://ko-fi.com/panda_paco/shop Stickers channel: @pacostickersTelegram
Oof. Reading this points out just how many devices won't or can't be updated to distrust the weak CA keys disclosed today. https is barely, if at all, more secure than http now, for those devices.
There's even the scenario where your phone asks Google or Apple if there's an OS update and they would like to say "yes, here's an update to your root certificate store", an attacker could now impersonate them and instead say "no, everything's fine and dandy".
Lovely.
One of eMudhra's certificate authority private keys is the number 4. Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4... Another one is 56, and another is 115.Scott Helme
They did the XKCD thing!
https://glauca.space/@q/117474051360413376
4 times the SECP384-R1 base point is(0x138251cd52ac9298c1c8aad977321deb97e709bd0b4ca0aca55dc8ad51dcfc9d1589a1597e3a5120e1efd631c63e1835, 0xcacae29869a62e1631e8a28181ab56616dc45d918abc09f3ab0e63cf792aa4dced7387be37bba569549f1c02b270ed67)https://repository.emsign.com/certs/EMOVTLSCAG3C.crt
for the non-cryptographers at the back of the room: the private key is 4, just the number 4, nothing more
Certificate:<br> Data:<br> Version: 3 (0x2)<br> Issuer: C=IN, O=eMudhra Technologies Limited, CN=emSign Root TLS CA - G3<br> Subject: C=US, O=eMudhra Inc, CN=EM OV TLS CA - G3C<br> Subject Public Key Info:<br> Public Key Algorithm: id-ecPublicKey<br> Public-Key: (384 bit)<br> pub:<br>04:13:82:51:cd:52:ac:92:98:c1:c8:aa:d9:77:32:<br>1d:eb:97:e7:09:bd:0b:4c:a0:ac:a5:5d:c8:ad:51:<br>dc:fc:9d:15:89:a1:59:7e:3a:51:20:e1:ef:d6:31:<br>c6:3e:18:35:ca:ca:e2:98:69:a6:2e:16:31:e8:a2:<br>81:81:ab:56:61:6d:c4:5d:91:8a:bc:09:f3:ab:0e:<br>63:cf:79:2a:a4:dc:ed:73:87:be:37:bb:a5:69:54:<br>9f:1c:02:b2:70:ed:67<br> ASN1 OID: secp384r1<br> NIST CURVE: P-384<br>
And that's how you compromise all of TLS, worldwide, in one go. (The broken CAs can presumably issue certificates for *any* name in DNS, and it's the same for all the dozens of other CAs, even the obscure ones, because most (all?) of the CAs in the root trust stores are not, as far as I know, scoped in any way.) (I'm sure someone will correct me if these "presumably"s and "as far as I know"s are wrong.)
Go to https://emudhra.we-have-a-problem.com/ , scroll down to "Does your client still trust the compromised intermediates?" and check that your browser is correctly failing to connect to certificates from all 8 of the bad intermediates.
4 times the SECP384-R1 base point is(0x138251cd52ac9298c1c8aad977321deb97e709bd0b4ca0aca55dc8ad51dcfc9d1589a1597e3a5120e1efd631c63e1835, 0xcacae29869a62e1631e8a28181ab56616dc45d918abc09f3ab0e63cf792aa4dced7387be37bba569549f1c02b270ed67)https://repository.emsign.com/certs/EMOVTLSCAG3C.crt
for the non-cryptographers at the back of the room: the private key is 4, just the number 4, nothing more
Certificate:<br> Data:<br> Version: 3 (0x2)<br> Issuer: C=IN, O=eMudhra Technologies Limited, CN=emSign Root TLS CA - G3<br> Subject: C=US, O=eMudhra Inc, CN=EM OV TLS CA - G3C<br> Subject Public Key Info:<br> Public Key Algorithm: id-ecPublicKey<br> Public-Key: (384 bit)<br> pub:<br>04:13:82:51:cd:52:ac:92:98:c1:c8:aa:d9:77:32:<br>1d:eb:97:e7:09:bd:0b:4c:a0:ac:a5:5d:c8:ad:51:<br>dc:fc:9d:15:89:a1:59:7e:3a:51:20:e1:ef:d6:31:<br>c6:3e:18:35:ca:ca:e2:98:69:a6:2e:16:31:e8:a2:<br>81:81:ab:56:61:6d:c4:5d:91:8a:bc:09:f3:ab:0e:<br>63:cf:79:2a:a4:dc:ed:73:87:be:37:bb:a5:69:54:<br>9f:1c:02:b2:70:ed:67<br> ASN1 OID: secp384r1<br> NIST CURVE: P-384<br>
Exacerbated by a search engine demanding TLS in entirely nonsensical situations to stay in search listings, only to get fucked over anyway.
@q
Intermediate CA compromised
@zrb @kawazoe @FamiliarDraco They're all under 256.
Naively, a for loop that meant to write the random bytes to a buffer but fucked up the pointer arithmetic could explain it.
For example:
void fill_random(uint8_t *buf, int fd) {<br> uint8_t *p = buf;<br> for (int i = 0; i < 32; i++) {<br> read(fd, p, 1);<br> (*p)++;<br> }<br>}<br>(*p)++ fails to actually move the pointer off buf[0].A similar version could have had them all overwrite buf[31] instead.
I'm sure the actual script they used is dumber in some other way.