æʃliŋ, loaf of autismo @aescling@cat.family

@Lady @coriander even websites which were on the latest PHP were still advised to go offline until actual patches were made available

@coriander remote code execution vulnerability on an extremely wide number of versions

mornyawn btw . also @clock, what time is it

ÆSCLING ACTIVATES the TF MACHINE!

ÆSCLING TRANSFURMS from GLACEON to EEVEE!

ÆSCLING SWISCHES its big fluffy $$$$-ing TAIL!

—

@coriander unrelated disaster

https://www.youtube.com/watch?v=Mz_Rn7jAKCc banger set

@vaporeon_ @amy @The_T apparently so that mozilla can control the certificates being used in the browser

@vaporeon_ @amy @The_T i mean, "not receiving push updates from a proprietary service run by mozilla" sounds like decision librewolf would make to me

@amy sounds like a great plan im sure there will be zero negative consequences here c:

@vaporeon_ @The_T lol

@amy @vaporeon_ @The_T mozilla have had a service to push certificate store updates without requiring updating firefox itself because of the severity of the issue. since 2015, apparently. so yeah they were quick on it

@The_T @vaporeon_ yes, exactly

thankfully, thanks to Let's Encrypt, certs can easily be obtained fur free these days. very, very quickly, too

@The_T @vaporeon_ Extended Support Release, older version that is actively maintained, usually targeting organizations who don't want to have to worry about updating things constantly.

(it is also the version purrovided by debian (popular linux based OS, the basis of the even more popular Ubuntu) by default because their entire goal is system stability; packages only update (security updates aside) when the entire goddamn system does)

(it is not infrequently purrefurred by the kind of nerd who does not like recent changes to firefox. i only use stable because a particular extension i wanted to install required a later version than the current ESR)

@The_T @vaporeon_ if you don't have to deal with IT this can be done in seconds with Let's Encrypt, maybe a minute or two if you've never used it befur

if you have to deal with an IT department to get a decision made on this kind of thing.... oh boy.......

@The_T @vaporeon_ there are no "good ones" to "re-import", the entire point is that certain certificate authorities are now known to be compromised and should be removed

ftr mozilla has a service they use to manage this exact kind of scenario fur users so you purrobably don't have to do anything, you can check at this section of the link vappy gave earlier; you want to see 0/12 connected

@vaporeon_ @The_T in non ESR firefox there's a submenu "Connection security" in Privacy and security, under "Certificates" click "Manage certificates"; by default it shows you certificate authorities, which is what you want here

@The_T @vaporeon_ if you remove the known compurromised root certificates then the browser won't trust certificates signed with them and will give you extremely loud warnings that something is bad and wrong