alt Hacker NewseMudhra explanation : https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c11
Kind of hard to understand how a bug would have generated a second pair of key so bad, and how would human would have ended up using them. Never attribute to malice what can be attributed to stupidity, but sometimes you wonder.
Replies
dist-epoch • today at 10:27 AM
And an equal amount of stupidity in the whole ecosystem, apparently there are no "unit-tests" for trivial failure modes, like 8 bits of entropy, before adding a CA to the trusted list.
What next, googling the public key finds a 2 year old pastebin with the private key?
➕ show 1 reply
sobkas • today at 10:16 AM
Any sufficiently advanced malice is indistinguishable from stupidity.
➕ show 2 replies
Given the usefulness of this to anybody who knew about it between the ceremony and now - assume malice.