floof.org
RE: https://tenforward.social/@nivex/117486661160031283
I've yet to see a human endeavour which isn't about money and power.
Computers were not a mistake.
The Internet was not a mistake.
The mistake was allowing everything to be about money and power rather than community building.
Here's Vaelen the marten.
This time I wanted to play around a little with lighting, shadows, and perspective, trying out a different angle with the sunlight hitting him. Mostly just experimenting and having fun with it!
Drawing for Archer
Traditional, markers and colored pencils.
If you want to watch the process of this drawing, I recorded a time-lapse video, you can watch the short version on the first comment of my Telegram art channel: https://t.me/panda_paco
The full version video, with the full resolution and scanned version of this, plus more drawings I haven't shared yet on my galleries, can be found as exclusive for Patreons and Ko-Fi monthly supporters. You can join the club and support to keep doing this for a living, and receive many exclusive shinnies.
Patreon: https://www.patreon.com/c/pandapaco
Ko-Fi: https://ko-fi.com/panda_paco/tiers
Thank you!
Official Art Channel 🇲🇽 Clean cute artist. Full-Time Panda. Here to paint some smiles. https://linktr.ee/panda_paco Patreon: https://www.patreon.com/pandapaco Ko-Fi Shop: https://ko-fi.com/panda_paco/shop Stickers channel: @pacostickersTelegram
Taken on the last day of WPAFW 2026, as the sun was going down. Sparkle Tooth (AKA Carpet Sample, per badge) and Zarkey pose behind the lodge.
#FursuitFriday #WPAFW2026 #Fursuit
Everyone took the shortcut through the graveyard.
It closed at night, but I was in a hurry, and the groundskeepers were busy watching The Big Game. They hadn't even seen me fall over the gate.
My phone lit the path.
A crack of wood made me jump. The gnarled hands clawing through the dirt made me freeze.
The zombie pointed at me, "Give phone!"
The rest of my walk was dark but I could still hear the zombie cheering its favorite team.
From a fun-loving kid in Glipwood, to the Strander Chief of the East Bend, to lowly wolf who can't remember his name, the brave High King of Anniera... Kalma...YouTube
Taken just after the Kaiju Stomp at WPAFW2026, where multiple Kaiju (fursuiters) rampaged through a city (cardboard boxes of various sizes).
I'm walking a bit oddly because my right bootie has come loose inside my hindpaw and I'm trying to make it to a seat before I lose the paw completely. Of course, as soon as I sat down the bootie slid back into place and stayed there the rest of the day.
📸 - Rump
#WerewolfWednesday #WPAFW2026 #Fursuit
@colinstu @pippin The long brown NFT fur "mane" over the shoulders and down the back was done back in 2002, but it needs sunlight to really pop.
I'm slowly replacing the shorter dark grey NFT fur on the rest of the body; for some reason it's kinked up over the years and just doesn't look good anymore.
Meet Stitches! Just a handsome fox looking pretty good without even trying.
This one was done traditionally with markers and colored pencils.
I also recorded a time-lapse video of the drawing process! You can watch it in the first comment on my Telegram art channel: https://t.me/panda_paco
As well, you can watch a longer video of the process, all the full files, and more drawings I haven't posted on my galleries, all this at supporting me on Patreon or Ko-Fi, check all the tiers and rewards you can get:
Patreon: https://www.patreon.com/c/pandapaco
Ko-Fi: https://ko-fi.com/panda_paco/tiers
Thank you!
Official Art Channel 🇲🇽 Clean cute artist. Full-Time Panda. Here to paint some smiles. https://linktr.ee/panda_paco Patreon: https://www.patreon.com/pandapaco Ko-Fi Shop: https://ko-fi.com/panda_paco/shop Stickers channel: @pacostickersTelegram
Oof. Reading this points out just how many devices won't or can't be updated to distrust the weak CA keys disclosed today. https is barely, if at all, more secure than http now, for those devices.
There's even the scenario where your phone asks Google or Apple if there's an OS update and they would like to say "yes, here's an update to your root certificate store", an attacker could now impersonate them and instead say "no, everything's fine and dandy".
Lovely.
One of eMudhra's certificate authority private keys is the number 4. Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4... Another one is 56, and another is 115.Scott Helme
They did the XKCD thing!
https://glauca.space/@q/117474051360413376
4 times the SECP384-R1 base point is(0x138251cd52ac9298c1c8aad977321deb97e709bd0b4ca0aca55dc8ad51dcfc9d1589a1597e3a5120e1efd631c63e1835, 0xcacae29869a62e1631e8a28181ab56616dc45d918abc09f3ab0e63cf792aa4dced7387be37bba569549f1c02b270ed67)https://repository.emsign.com/certs/EMOVTLSCAG3C.crt
for the non-cryptographers at the back of the room: the private key is 4, just the number 4, nothing more
Certificate:<br> Data:<br> Version: 3 (0x2)<br> Issuer: C=IN, O=eMudhra Technologies Limited, CN=emSign Root TLS CA - G3<br> Subject: C=US, O=eMudhra Inc, CN=EM OV TLS CA - G3C<br> Subject Public Key Info:<br> Public Key Algorithm: id-ecPublicKey<br> Public-Key: (384 bit)<br> pub:<br>04:13:82:51:cd:52:ac:92:98:c1:c8:aa:d9:77:32:<br>1d:eb:97:e7:09:bd:0b:4c:a0:ac:a5:5d:c8:ad:51:<br>dc:fc:9d:15:89:a1:59:7e:3a:51:20:e1:ef:d6:31:<br>c6:3e:18:35:ca:ca:e2:98:69:a6:2e:16:31:e8:a2:<br>81:81:ab:56:61:6d:c4:5d:91:8a:bc:09:f3:ab:0e:<br>63:cf:79:2a:a4:dc:ed:73:87:be:37:bb:a5:69:54:<br>9f:1c:02:b2:70:ed:67<br> ASN1 OID: secp384r1<br> NIST CURVE: P-384<br>
And that's how you compromise all of TLS, worldwide, in one go. (The broken CAs can presumably issue certificates for *any* name in DNS, and it's the same for all the dozens of other CAs, even the obscure ones, because most (all?) of the CAs in the root trust stores are not, as far as I know, scoped in any way.) (I'm sure someone will correct me if these "presumably"s and "as far as I know"s are wrong.)
Go to https://emudhra.we-have-a-problem.com/ , scroll down to "Does your client still trust the compromised intermediates?" and check that your browser is correctly failing to connect to certificates from all 8 of the bad intermediates.
4 times the SECP384-R1 base point is(0x138251cd52ac9298c1c8aad977321deb97e709bd0b4ca0aca55dc8ad51dcfc9d1589a1597e3a5120e1efd631c63e1835, 0xcacae29869a62e1631e8a28181ab56616dc45d918abc09f3ab0e63cf792aa4dced7387be37bba569549f1c02b270ed67)https://repository.emsign.com/certs/EMOVTLSCAG3C.crt
for the non-cryptographers at the back of the room: the private key is 4, just the number 4, nothing more
Certificate:<br> Data:<br> Version: 3 (0x2)<br> Issuer: C=IN, O=eMudhra Technologies Limited, CN=emSign Root TLS CA - G3<br> Subject: C=US, O=eMudhra Inc, CN=EM OV TLS CA - G3C<br> Subject Public Key Info:<br> Public Key Algorithm: id-ecPublicKey<br> Public-Key: (384 bit)<br> pub:<br>04:13:82:51:cd:52:ac:92:98:c1:c8:aa:d9:77:32:<br>1d:eb:97:e7:09:bd:0b:4c:a0:ac:a5:5d:c8:ad:51:<br>dc:fc:9d:15:89:a1:59:7e:3a:51:20:e1:ef:d6:31:<br>c6:3e:18:35:ca:ca:e2:98:69:a6:2e:16:31:e8:a2:<br>81:81:ab:56:61:6d:c4:5d:91:8a:bc:09:f3:ab:0e:<br>63:cf:79:2a:a4:dc:ed:73:87:be:37:bb:a5:69:54:<br>9f:1c:02:b2:70:ed:67<br> ASN1 OID: secp384r1<br> NIST CURVE: P-384<br>
Exacerbated by a search engine demanding TLS in entirely nonsensical situations to stay in search listings, only to get fucked over anyway.
@q
Intermediate CA compromised
@zrb @kawazoe @FamiliarDraco They're all under 256.
Naively, a for loop that meant to write the random bytes to a buffer but fucked up the pointer arithmetic could explain it.
For example:
void fill_random(uint8_t *buf, int fd) {<br> uint8_t *p = buf;<br> for (int i = 0; i < 32; i++) {<br> read(fd, p, 1);<br> (*p)++;<br> }<br>}<br>(*p)++ fails to actually move the pointer off buf[0].A similar version could have had them all overwrite buf[31] instead.
I'm sure the actual script they used is dumber in some other way.
Enjoy the videos and music that you love, upload original content and share it all with friends, family and the world on YouTube.YouTube
so the “you need an EV” thing… I mean we didn’t have an EV or a charger when we signed up and they didn’t check at all! We do now though.
Indeed Go is just two rates.
I looked at Flux but it worked out a bit more expensive when I did the modelling… maybe that’s different now though.
It's pumpkin spice latte season, and here's a little Kazan enjoying a lovely autumn day on a swing!
This drawing was inspired by a photo of Kazan in his fursuit, sitting on a swing and looking a lot smaller than usual!
Wishing a very happy birthday to a wonderful friend!!
I also made a time-lapse video of the drawing process! You can watch it in the first comment on my Telegram art channel: https://t.me/panda_paco . Also I'm sharing there the picture, taken by Koidel, the one I got inspired for this illustration.
And you can watch the full video, the scanned version, the full resolution, and more pictures I haven't posted on my galleries yet, all that at supporting me monthly on Patreon or Ko-Fi, this also helps me a lot to keep living out of this and be able to work on more projects, and I always give so many exclusives to those who supports me and join the Clubhouse
Patreon: https://www.patreon.com/c/pandapaco
Ko-Fi: https://ko-fi.com/panda_paco/tiers
Thank you!!
Official Art Channel 🇲🇽 Clean cute artist. Full-Time Panda. Here to paint some smiles. https://linktr.ee/panda_paco Patreon: https://www.patreon.com/pandapaco Ko-Fi Shop: https://ko-fi.com/panda_paco/shop Stickers channel: @pacostickersTelegram
Electro Andes is a young adult 2D action sci-fi series blending cyberpunk, Andean mythology, ecological conflict, and South American anime energy.Two brother...YouTube
Jackie's first year at art school curdles into cosmic horror when her friend Jimmy vanishes, and she alone remembers him. Her search for answers leads her to...YouTube
Content warning: depresso thought